[allenz]

Code signing and decryption both require access to the private key, possibly through a hardware security module. I don't see why decryption has less exposure.