Whatever you do, if you are high value then you should consider the risk that your source repository could be compromised too. Using separate hardware signing k

Whatever you do, if you are high value then you should consider the risk that your source repository could be compromised too. Using separate hardware signing keys for git/whatever is something you should therefore also strongly consider I think. Reproducible builds can also help you to mitigate this risk - so you then can cross check that the source is properly signed and produces the right binary before signing the binary. If you are publishing source code then your customers can also double check this as a second vector, should they want to.