Neither of these will work, because (a) the signing key is per-developer and (b) the entire point is that when your malware is found to be signed with key X, key X is revoked and your software no longer runs. That's the purpose of the system...
He's referring to the master key, which will be used to sign the per developer signing keys. If that is stolen, then it will be possible to sign arbitrary signing keys and issue arbitrary revocation certificates.
And is, again, instantly revokable. It'll be annoying if it's stolen, but you just revoke it, give the company the new one, and update the app in the app store (or your download, if you're not in the store). This is arguably far better than being unknowingly hit by malware.
