OK, I've had enough of this. Time for someone who actually owns and uses both carts, and actually does these things, to set the record straight. CIAs do not have headers. You can make CIAs from scene releases, and they will play online. If they used their invalid blank header, that would not be the case. There is no such thing as a CIA with a public header. If anyone got banned for them, it's not because the CIA had a public header. They probably made the mistake of going to the eShop using the card the CIAs are installed on. You should know better. There's a reason things disappear (especially themes) when you do that. Nintendo checks everything you've got installed when you visit the eShop. Going into it with CIAs installed is like waving a big flag in front of Nintendo that says "I'm using DevMenu to install content I didn't buy". Be smart, and use a clean second card with no CIAs installed to access the eShop. Follow this advice, and you probably won't get banned for playing CIAs online (based on what we currently know).
You know how to point people to the more complicated process of CIA conversion, but are completely unfamiliar with the relatively simple process of patching a header? OK, read and learn. All you need to do is look for a tool called "Gateway ROM Patcher". Just load two copies of that. Open the ROM you want to take the header from in one, and the ROM you want to patch in the other. Then just copy and paste the Cart ID from the top part of the first instance to the bottom part of the second instance. And if the Chip ID is blank, have it guess, it usually gets it right, or just look it up. Hit the "apply" button on the second instance and you're done. Rename the newly patched .3ds file to .3dz and copy it to the Micro SD card. It's extremely simple (especially compared to doing a CIA conversion).
Now, in response to the whole "Sky3DS users are screwed" noise, the template file is a plain text file. You can easily modify the Unique ID entries for the online games you're playing. My recommendation is to create a custom template file containing only the entries you want to play online (and therefore need to modify), and add your unique IDs to that one. When a new template comes out, just copy and paste the entries from the new file that you want to play online (they'll be near the bottom). Having a template file containing only the games you're adding custom IDs for makes it easier to change the IDs again in the unlikely event one of your private keys gets banned. It takes a little time to set up initially, of course, but not much more than patching ROMs individually (and certainly much less than converting everything you want to play online to CIA, never mind installing said CIAs). Just use your custom template file to write your online games, and the regular one to write the rest. It's not like the Sky3DS is a more vulnerable device necessarily, you just have to do your homework. Running a .3dz with a public ID on the Gateway will get you banned just as quickly.