Ask HN: How are important signing keys secured?

How do companies like Apple , Google etc secure the keys they use to code sign binaries that allow them to run on Android or iOS ? And how would they be able to mitigate the keys being stolen ?