Your signing key should never be a file.
SignetKeys is hardware-custody Apple code signing for macOS apps and audio plugins. The signing identity is generated inside a hardware token and can never leave it. A release pipeline presents an identity token — never a secret — and gets back a signed, notarized, stapled artifact plus provable evidence of exactly what was signed, from which commit.
The Problem: a Private Key in Every Build
The industry’s standard practice is to export the code-signing certificate as a file, encode it, and store it in CI secrets. On every build, the pipeline reconstructs the private key to sign with it. That key is the developer’s identity — the thing operating systems trust when they let software run.
The Key Is a Readable String
Inside the build environment, the private key exists as data. Exfiltration is one line of script — and build environments run a lot of other people’s script.
The Blast Radius Is the Supply Chain
Anyone who can edit a workflow, any compromised dependency, any mutable build action, any dirty runner can reach the key. The perimeter is every line of the build.
Compromise Is Catastrophic
An attacker who signs malware with a stolen key inherits the developer’s trust. Revoking the certificate breaks every legitimate build ever shipped with it.
What SignetKeys Does
SignetKeys removes the key from the equation entirely. Custody, policy, and evidence — as a service.
Keys Born in Hardware
The signing keypair is generated on a hardware security token and can never be exported. It never exists as a file, never touches a disk, never appears in a backup — with cryptographic attestation of that fact.
Zero Secrets in CI
Pipelines authenticate with short-lived workload identity (OIDC), not stored credentials. Policy decides which repository, branch, and workflow may request a signature. There is nothing in CI to steal.
The Full Apple Pipeline
Sign, notarize, staple, verify — the complete Developer ID release flow for apps, plugins (VST3/AU), and installers, executed under policy on dedicated hardware.
Provable Evidence
Every signature is recorded in a tamper-evident chain: input hash, output hash, commit, actor, certificate, notarization ID. Releases become auditable facts, not folklore.
Same Thesis, Different Industry
In healthcare, PersonixHealth builds the governed layer that lets AI execute access to care. In software delivery, SignetKeys is the governed layer that lets CI execute a release — without ever holding the credential. Both are the same product idea: a system that exercises a high-stakes capability on your behalf, under policy, with provable evidence. We call it governed execution infrastructure. SignetKeys is that idea applied to the software supply chain.