Within the boundaries of the current system, sure, but it still can be accomplished. So long as builds are reproducible, signing and responsibility can be done

Within the boundaries of the current system, sure, but it still can be accomplished. So long as builds are reproducible, signing and responsibility can be done entirely at the source control end. If you want an example, just look at Nixpkgs.