CircleCI to start support signing the keys via AWS KMS, CloudHSM, or an external HSM where private key material never leaves the cryptographic boundary. Looks like the signing code in oidc-service loads the private key into memory and uses the Go lestrrat-go/jwx library for in-process RSA signing. There is no pluggable signer interface, no KMS client, and no HSM integration point. It would be great if circleci enable KMS/HSM integration