Signing a package at build-time. Replacing the signature on an already-existing package. Adding a signature to an already-existing package.
Lets take a look at each one, starting with build-time signing.
When this option is added to an RPM build command, RPM will ask for your PGP pass phrase. If the pass phrase is correct, the build will proceed. If not, the build stops immediately. Pass phrase is good. Once the pass phrase is entered, there's very little that is different from a normal build.