What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines.
I see systems like Amazon Key Management Service and Microsoft Key Vault that seem to be ideal for this, but I don't think that it is actually possible to use them for iOS and Android apps. To me, it looks like the ideal way to handle this, would be that the code is submitted to a centralized key server, which signs the code for the developer, without ever revealing the private key to the developer. Change developers, and you simply revoke their access to the key management server. Then you also have one strategy to handle all of your various keys. It also seems easier to integrate with continuous delivery.
Is there any strategy that organizations use to manage their private keys for code signing both ios and android apps?