I've been reading up on artifact signing, trying to set up a proper pipeline for my self-hosted agents. The traditional workflow with long-lived keys always made me nervous — key storage, rotation, and revocation seem like a lot of moving parts for a beginner like me.

Then I keep seeing "keyless signing" mentioned, especially with Sigstore. I understand the general promise: you prove your identity (like via a GitHub OIDC token) and get a short-lived certificate to sign something. The artifact gets signed, and the proof is stored in a transparency log.

But here's my mental block: if it's "keyless," what actually creates the cryptographic signature? There must be a private key involved *somewhere*, even for a short time, right? Is it generated ephemerally on my machine, used once, and thrown away? And if so, who or what is the trusted party that issues the short-lived certificate binding that ephemeral key to my identity?

I guess I'm trying to map the "keyless" term to the concrete steps. A simple example of the flow, pointing out where that temporary key material lives and dies, would really help me trust the process before I try to implement it.

Paul