Try this:
Start the SQL Server Management Studio using the following at a command prompt:
runas /netonly /user:targetdomain\targetuser "C:\Program Files (x86)\Microsoft SQL Server\140\Tools\Binn\ManagementStudio\Ssms.exe"
Substitute targetdomain above with the AD domain that the remote SQL server is in, and substitute targetuser with the AD username that has the SQL permissions. Also, the path to the SQL Management Studio above may be different on your computer - substitute your path accordingly.
It will prompt for the AD user password. The password must be typed, can't easily be scripted (not going into that now, there's some vbscript solutions to get around the password thing).
What the above does is runs your local management studio program "as" an AD user on the target domain. Now you can create a regular "SQL Server" linked server using the current login's security context...But we're fooling it into thinking you are on the remote domain.
pretty slick, eh!
Has some obvious drawbacks, BUT it gets the job done.
--Eric