And given that the malware version was signed using SolarWinds' keys, it's likely the attackers just built and deployed their compromised versions using the reg

And given that the malware version was signed using SolarWinds' keys, it's likely the attackers just built and deployed their compromised versions using the regular TeamCity CI servers. No need to exfiltrate the signing keys if you can get control of the CI/CD system. It's less likely to be logged, it has the same effect, and such servers regularly contact the outside world to download dependencies. And if the admin password to the CI/CD was "Solarwinds456!" or similar (as seems in character, if possibly overestimating their intelligence by adding "special characters") it wouldn't matter what CI/CD software they'd used.