GPG signature should be generated prior to 'install' phase.

* There can be issues for the local repository if the signature happens after the install
  to local repository cache.
* Only people with the GPG key should be running with the 'junit-release' profile active
* Therefore safer to move the execution to the 'verify' phase