I summarized the general idea in issue #4531: Automated signing of Stable and Preview build artifacts