So long as builds are reproducible, signing and responsibility can be done entirely at the source control end.

If you want an example, just look at Nixpkgs.