Unless I'm misunderstanding what you are referring to by signing:

FWIW, A source code leak would not typically also include signing keys unless explicitly included. At any large org, there is a good chance only a handful of people will have access to a given signing key. So it's unlikely the method by which the code was accessed, would also provide access to signing keys

I mean, you could probably do that too.