The is the obvious next step for the industry/technology. I think a better answer is to maximally reduce the potential fallout from a compromised employee.

This is easier said then done and if you go the direction of complicated procedures employees will usually just try to bypass procedures entirely.

However I think there is a middle ground or a sweet spot here. The tech has come a long way in the past decade or so. Its pretty easy to have a set up where almost no employee can deploy to production from their local machine.

Its also the easiest its ever been to have a sandboxed production environment and a near parallel staging environment.