You distribute the code without your key and a built package that is signed. This isn't exactly rocket science.

Anyone who forks the code will have to use their own key to install a package they built.

It's just unnecessary red tape.