For Windows software developing companies, it is a good practice to have their EXE/DLL/SYS files signed with a code-signing cerfiticate. For example, Google Chrome executables have digital signatures.
But, I think it is a bad practice to have each developer install a copy of code-signing certificate(CSC) in their development machines, because CSC's private key should not be directly accessible to each developer, right? That private key should be known to only one Administrator so only this Administrator is responsible for keeping that key secret.
So, I think there should be a code-signing server set-up by the Administrator, and individual developers should upload their executables to the server to receive actually code-signing. Of course, the server keeps a log of which file is signed by which developer. In case there is a violation of the corporate rule(e.g. a bad guy signs a malware with corporate's CSC), we can trace back to find out the bad guy.
Does such a server software exist in the market? If not, how do those many software companies cope with such a requirement?