Separate service, separate key, separate container. Releases a bounty only after independent verification — a key the red team never holds.
Separation of duties is the product: if the auditor could pay itself, the signature would mean less.