Is there a way to sign builds without a physical device?

The signing is one problem, you need a device but that could plausibly be automated by using a build machine with a Roku attached to it (and a lot of fiddly scripting to switch keys - tricky).

The deployment would still have to be manual though, via Roku's dashboard which has Captchas blocking automation.

I have a similar issue but thankfully there aren't enough different clients yet to make it a huge headache.