+the source code and the build outputs has no access to the key:
+
+1. Clone on build host (dgit clone)
+.br
+2. Edit code on build host (edit, git commit)
+.br
+3. Build package on build host (dgit build)
+.br
+4. Test package on build host or elsewhere (dpkg -i, test)
+.br
+5. Upload by invoking dgit rpush on host with your GPG key.