I have a system (lets call it signer) that has private keys for doing Authenticode code signing. I have bunch of build systems that want to sign generated build artifacts. Obviously I can't use signtool directly on build systems as private key is not available. Currently we copy binaries to signer box. Copy them back after signing. That is like moving a mountain back and forth instead of asking the priest to deliver his sermon at the mountain. I am looking for a creative solution where I run signtool on build machine using TBD CSP (Crypto Service Provider). The CSP in turn sends the hashes to signer box. Gets signatures back and passes them to signtool. That way I am passing hashes instead of whole file.
I believe commercial HSMs employ similar techniques. I am wondering if there are builtin features in Windows to create a custom CSP like what I want to solve this problem. Otherwise how does one build a custom CSP to support this model for Windows 10+ systems?
I appreciate your pointers.