How is the security of the remote code signing service ensured?

Private keys are generated and stored in FIPS 140-3 compliant hardware cryptographic modules, and can never be exported; complete audit logs are provided; full end-to-end encryption is applied during data transmission.