I would love to see a postmortem for how they were handling their code signing cert. Right now I get a "PFX file on a network share and everybody knows the pass

I would love to see a postmortem for how they were handling their code signing cert. Right now I get a "PFX file on a network share and everybody knows the password" kind of feeling.