Who is allowed to touch the signing key
Builds emit a signed statement describing how the artefact was produced — which source, which workflow, which parameters. The signing happens in a step defined in the repository's own build file, because that was the easiest place to put it.
Anything a contributor can change can now sign a statement claiming anything. The attestation says what the build script says it says.
Boundaries, outermost first: User-defined steps: Build steps (from the repo) Build platform: Artefact, Signing key (must stay unreachable) Outside every boundary: Repository (anyone can propose), an empty slot for the who generates the statement Connections: Repository calls Build steps (step 1) Build steps calls Artefact — produces (step 2) who generates the statement controls Artefact — signs it (step 3) Signing key controls who generates the statement — only the platform reads this Build steps must NOT reach Signing key — must be impossible