Only check the signature on released tarballs