Yeah was thinking that; this would be generated and stored in an HSM ;it would be impossible to retrieve it even if you have access to the HSM in the network (

Yeah was thinking that; this would be generated and stored in an HSM ;it would be impossible to retrieve it even if you have access to the HSM in the network (one of the devs). You could sign with it but not actually distribute it. There are relatively easy and cheap ways to do this these days (aws cloudhsm for instance) so it is all a bit strange.