In bug 793876 we created (or are in the process of) creating a temporary signing service for apps. For that we aren't using the HSM or anything fancy. We are using xpisign and hope that will work (we have to test that end to end). As discussed at a meeting, we'd like to set up a proper signing service, that's outside of the marketplace process, utilises the HSM and provides lots of functionality, such as signing for reviews. This tracking bug is for the implementation of that.

Hey Ryan - let Andy and I know if there is anything you need for this. Thanks!

I think this is done, or else it's a dupe of bug 818641 which is deploying the signing service in production. Calling this fixed but let me know if I'm missing something.