Q:

How to share EV Code Signing Certificate with USB token with other developers? 

I got the Extended Validation Code Signing Certificate from Global Sign
https://www.globalsign.com/en/code-signing-certificate/
They sent over a USB Token which I installed the certificate to ... or that's what I think I did. 
My question is (how) can remote developers use that certificate or is the signing now limited exclusively to my machine / USB? 
Any help is appreciated.  Thanks. 

A:

To sign, you need the private key and the cert.  It sounds like the private key is on the USB, but I can't be sure. 
Best practices is to keep the private key, well, to keep it very private.  It is generally only stored on a single machine and an automated workflow is used to copy binaries to that machine for signing.  That machine should be as vanilla as possible to reduce the chance that it is vulnerable to an attack.  
The reason for such care is that malware authors really like to get their malware signed with a valid, trusted code signing key.  There's a famous case where, despite very strong security, Adobe's private key was used to sign malware.  Now Adobe's code signing key is much more attractive to an attacker than yours due to the fact that many people have already told their computer to trust Adobe's key, but basic security practices such as those described above are still appropriate.  Remember that it is your company's reputation at stake if you end up signing malware with your key.