...

In case a new built has to be released (even for a minor bug), the release will have a new version and will need to go through LF to be signed and released in Nexus Release repo.

Private Key Handling

LF has key protection controls in place.  Sigul, and its integrated into the tool chain.

OpenDaylight (ODL) Signing Process

...