At the large enterprises I've worked at, signing with our certs had to happen on our own build machines. And I don't think there was any precedent if we could s

At the large enterprises I've worked at, signing with our certs had to happen on our own build machines. And I don't think there was any precedent if we could sign third party binaries that had been built for us. Having some my-company.terminalwire.com as the signing identity could work; I bet most SMB wouldn't bat an eye to ship like that.