At my last company, signing keys were physically stored in a safe with limited access. No network security breach could possibly get them.