[gentoo-hardened] Remove toolchain?

[Hinnerk van Bruinehsen]

Hello everyone,

I'm trusted with building a hardened server. I'm using Gentoo on my
desktops for years, so hardened Gentoo is an obvious choice for me.

But there is one thing which disturbs me: Since Gentoo (and hardened
Gentoo) is sourcebased, i'll need a complete toolchain to keep the
system up to date.

I don't like the idea of giving this tools to someone who might
compromise the server.

Is there a way to keep the toolchain on a thumbdrive or in an encrypted
partition, so that a possible attacker can't use it, while I have still
access to it? Does a how-to or a guide exist, which coud guide me
through the process of setting it up correctly?

A quick google-search turned up nothing, though it may be possible, that
I'm just using the wrong keywords.

Any help would be greatly appreciated!

Kind regards,

Hinnerk