only enable gpg sign when gpg-sign is enabled explicitly: mvn -Dgpg-sign=true install