The resistance would very likely have other countries supplying weapons.

The generals quite realistically cannot stop him, short of an active coup.
The launch process is based on authentication, not authorization. As such, people who are not present are asked to verify various authentication codes. The details of the order are often not even visible to the person in question.
This allows for training exercises that are indistinguishable from a real launch order until the people in the bunker turn their keys and the readout tells them that no launch has occurred.
The selection process involves finding people who say they're willing to kill a billion people without questioning it, screening out those that want to so you just have the ones who follow orders and don't care, giving them snuggies, locking them underground for long enough that they're not certain about world events, and occasionally handing them a loaded gun with orders to point it at the world's head and pull the trigger before they find out if it's a blank or not. If they even hesitate you replace them.

The orders are pre-cached and distributed after being vetted by lawyers. The soldiers are then trained that the order are pre-approved as legal so questioning the legality isn't valid.

The only safeguard is for one of the few people who both know the order and is responsible for verification of identity to just refuse to validate the code.
In this case, that would mean relying on Hegseth to object.