I definitely understand your security concerns. My background is actually in security research. The architecture we're implementing will prevent arbitrary code execution on your servers if we were compromised by ensuring only signed code is executed. And, of course, code signing will be done offline.

Relatedly, here's some of my research on creating software update and deployment systems that are resilient to compromise:

https://www.eecs.berkeley.edu/~jsamuel/papers/survivable-key...