I am creating an application that will automatically sign code with secure keys (
.key). The app will run on Windows environment developed in .NET environment (C#). Signing is simple: source code + keys will generate signed artifacts. This is already in place. The challenge that I am facing is how to store the keys as secure as possible.
What I am considering is to encrypt the keys with tools like VeraCrypt. Whenever the app needs to sign code, encrypt the files, sign it and decrypt again. VeraCrypt for instance offers command line options for this. This then raises another issue: How to store the passphrase in the app safely.
Since I am not a security expert, could you provide me some comments on proposed solution? What other options would be appropriate and maybe better ones?