How do I sign NuGet package built by CI/CD on GitHub

[SetTrend]

Select Topic Area

Question

Body

I'm new to this, so please bear with me. I couldn't find documentation on my question:

I'd like to build and sign a .NET project on GitHub using CI/CD and have it published to NuGet.org.

I'm about to buy a CodeSigning certificate. This certificate will be stored on a USB token stick and, AFAIK, the private key must/can not leave the stick.

How would I have my .NET project getting signed using my future CodeSigning certificate on GitHub/GitLab CI/CD? What are the necessary steps required?