http://4gmrlefxkq4mtan6a2lqwfwa7un4brjlatka75nwdczemqqwn3wznnad.onion/en/BestPractices/CodeSigning
Keep the token physically separate from the device that hosts the code signing function until a signing session is begun. If private keys will be transported, ensure that passwords are randomly generated with at least 16 characters containing uppercase letters, lowercase letters, numbers, and symbols.