Fix a signing bug.

We were signing the packages after building the database. Since the
database stores the signatures, we have to sign the packages before
building the database.