You add another stage. 1. A release candidate X is tested in a CI 2. If tests pass, the CI sends a notification to the build server. The notification is "prep

You add another stage. 1. A release candidate X is tested in a CI 2. If tests pass, the CI sends a notification to the build server. The notification is "prep for release package <hashid>" 3. Build server pulls code from the repo, matches it against "ready, CI passed" notification and builds the package/packages. Compromise of the entire CI/dev chain would be contained as the builders act as a new pipeline entry point running in parallel of the CI using pull method. To compromise keys located on a build server one would need to either get access to it via whatever the method of remote access the server has ( which should be nearly none ) or figure out how to compromise the code running on the builders using the input from a repo that passed CI.