How do you offload to silicon periodically creating a new private key to sign your future releases, but keep it far away from your builds until you actually will use it, but put its public key on the builds.