I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I can detect if the private key has been compromised?
The most obvious sign will be a breach in general, but does this mean that I should automatically assume the private key has been compromised no matter what? I hope this doesn't sound like a stupid question. Revoked keys will cause a significant problem, especially if I can't determine the exact time the key was compromised. Tools like FIM can be used to detect modifications, and an auditing solution to track file access. But it seems to me once there's been a breach, no matter how tiny, all bets are off.