FunkyCIA seems like it's able to pull tickets from ticket.db file and is an alternative to the cdnto3ds python script which is definitely showing it's age.
I just used rxTools to dump my ticket.db once i had downloaded the patch in my 9.6 emunand. Then I roll back that emunand to 9.5 so Gateway will still work. Then used Decrypt9 to decrypt the title keys so I can generate a decTitleKeys.bin file for use with the printkeys python script. (for some reason the title keys decrypted direct from rxTools doesn't work with this python script, otherwise I'd skip using Decrypt9 entirely) id rather not. Have to. Re setup. Emunand. Backup all the. Saves and reinstall
From there I just use that above mentioned python script to download it using the title ticket (or key. I keep switching between the two terms.

)
I made two CIAs. The one it automatically made which I believe has my title key so it's a legit CIA tied to my console and a second built from the "decrypted" CXI (the .dec file it generated) which isn't fully decrypted, but should be installable on other 3DS consoles. That one is the one I'll make public.
I just now got it downloaded. CDN just doesn't get along with my internet for some reason as I had to restart the download a few times because it kept getting cut off. So annoying.
EDIT: Lol technically I didn't even need to do all of this. Apparently after I rolled emunand back to 9.5, the new patch installed to SD card STILL WORKS! (and I know this because it said 1.3 in the save load screen in Alpha Sapphire) Which perhaps makes me believe the patches use the same title key as the last version of the patch? Interesting. Though if you never installed any of the updates from eShop in the first place you will be in for the more complicated method of getting them.
So for the rest of you...just download the update in rxMode CFW (go to system settings and update first. Don't update emunand using eShop. I've heard mixed results about that. Of coarse backup your 9.5 emunand first) Once it's installed roll that sucker back to 9.5 and there you go. You updated your pokemon gamez.
For n3DS users with NAND mods, the process is a bit more complicated. If you had installed at least one update for all your pokemon games, this should work for you too. Just flash your current emunand over to sysnand. Then update it to 9.6. Then download the updates. Then restore your sysnand backup. Boom. You got the updates installed! Note that you must have a NAND mod if you have a n3DS because 9.6 for n3DS fixed the crypto and it will be a long time before 9.6 will boot in emunand. You will instead have to run your current emunand on sysnand and update it there. This is why a nand mod is needed so that you can downgrade back to 9.2 fw to restore your exploit entry points.
Note the above would only work if you had installed at least one of the previous updates of your target games from the eShop. Patches you downloaded from romz sites don't generate legit tickets, so yeah, that won't work in this case.