Hide the signing key

[zimbatm]

Is your feature request related to a problem? Please describe.

It prevents the team from growing.

I'm just recording this to remember the conversation with @delroth

Describe the solution you'd like

Either a HSM, or an upload machine that can hold the key, sign and upload.

Describe alternatives you've considered

Additional context

[vcunat]

After we have workflow with a locked-down key, it would make sense to me to rotate it NixOS/rfcs#149

Well, these two could be independent, but rotation seems to require relatively lots of work, so I think it's better to rotate directly to a key that's better secured from the start.

[cole-h]

For any interested parties, we're discussing what this would look like / how it should be approached in the following Matrix room: https://matrix.to/#/#nixos-infra-signing:matrix.org

Please feel free to join and chime in if you have ideas!