A rant - getting PTF's for IBMi - a real hassle

This is more of a rant than a request for a solution but if somebody has an
idea I would be keen.

We recently installed a couple of Power servers(8 and 9) as part of
migrating a major application from another site. Up till now we had no
Power servers and no IBMi.

The servers were build from tape dumps from the source site and then
upgraded to IBMi 7.3 using DVD's :-( These were not easy to create and
had to be created off the corporate network and DVD's burnt).

The support vendor we chose after a long RFP process has now got onto the
servers and said we are in urgent need to patch the OS.

OK. Our policy was we would download patches and place them on a Windows
Terminal Server they could then use to access the Power servers, either via
ACS, WinSCP (to send files) or Chrome to access HMC etc.

So off to Fix Central to get the patches and this is where the rant comes
from.

Fix Central only offers 3 methods of downloading patches, all relying on
Java (Download DIrector).

Of course being a large financial institution and strict Internet access
controls, Download Director failed because the IBM site which contains the
jar file was blocked. Pleading with the security team I managed to get the
site blocked and was able to install Download Director only to have it fail
the connection to the IBM site because it needs access to the corporate
proxy server. And while I think I put in the right proxy server, it seems
to rely on AD authentication in your Windows session so that failed (but I
am asking if I can find a way around this).

There was an option to download directly to the Power server so I chose one
CUM and it seemed to work once I presented QSECOFR credentials to the
application. The PTS's all loaded into some library on the server where
they can be installed but they cannot be readily migrated to our three
other LPARs so this is not a good process either.

SFTP is another option so I chose that and was eventually given
logon instructions, But of course port 22 is blocked and there doesn't
appear to be a way to route 22 traffic via the proxy.

I can grab all the files from my home PC but I cannot get to them to the
corporate network.

What makes it really annoying is we also bought two IBM Storwize V5030 All
Flash SANs to go with our Power servers. We plan to use Metro Mirror to
replicate our SANs across two data centre locations over a 10Gb fibre
connection. The vendor said the SANs also needed maintenance as they only
had the software levels on them from the factory. The Sysprog (who is also
a mainframe sysprog) got the patches with no problem from FixCentral since
the SAN software site offered https as an option!

https would be great for IBMi patches but that does not appear to be an
option.

Just wondering how this IBMi community working in a large corporate
environment with strict Internet access, manage their patching?