Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, where the private key is stored and can't be exported.
SW company that wants to sign an app with EV certificate probably has automated build/deployment process. The build infrastructure is either (1) in cloud, or (2) locally in a server room/building, or worse (3) in a rack in their office. Having the "sign" server separate is probably the best idea, the signing device is connected to it and release executables are only signed on this server.
My question is: Where to put this sign server in all three scenarios?
If we have our build infrastructure in the cloud, should we tunnel to a local VPN where the sign server is located? Where should the sign server be in this case?
Or even if we have our private build infrastructure locally, should the "sign" server just be a random server in server room/building along with other 10s or 100s of servers? Will I just plug the sign device to USB of one seemingly "random" server in the server room? Maybe a better approach would be to have a special room with cameras and restricted access. What if we don' have a private server room though? What if we rent a rack? Should the key just "lay around" in the rack?
How to scale this? What if we have 10 different apps with different keys? Do we go to this server every year and change it physically after expiration?
This thread is partially related What Are Good Code Signing Environment Guidelines?, but it was closed as too broad.