Where does the RHEL 7 source code live?

I would contend that for Red Hat the signing key is business critical, but the git.centos.org repository is not. So no doubt the key is well secured, and the process to sign packages is well protected as it would hurt their business and harm the trust customers have in them. git.centos.org not so much.

What's more, git.centos.org has (the same and) more attack vectors than the signing key/SRPMs used to have. So overall it is less secure as the previous way of working (which was the same for customers as it was for everyone else).