> These keys are usually stored on a HSM. Even if you want to, you wouldn't be able to access the keys stored inside. This is specifically designed to protect against rogue/bribed personnel.

Sure now they often are - after many security failures 10 years ago before HSMs were widely deployed. A decade ago a much more common ‘secure’ mechanism was to store the keys on an airgapped machine that had never been connected to a network and use sneakernet to get binaries signed.