Does that mean the laptop was compromised or the DevOps engineer was?

That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.