Explain how code signing works and how to protect code-signing private keys in a distributed engineering team.