We have a Jenkins system that builds and PGP-signs software releases, and we are considering moving the signing component to an isolated VM instead of running it as part of the overall builder infrastructure -- in order to better isolate the private keys from all the other relatively public moving parts.
A few developers are arguing against using a VM, since VMs usually have few sources of good entropy and therefore are not generally well-suited for cryptography. I want to put forth a counter-argument that since we'll be using PGP keys generated elsewhere, the only crypto operations that will be done on that VM will not be relying on RNG at all. My understanding of PGP signing process is that it calculates a sha1/sha2 hash (no RNG used) and then calculates the signature using the private key (no RNG used).
Is that correct? Or am I missing something that would make strong RNG a requirement for a system that only PGP-signs but never PGP-encrypts?