sign the package with the gpg private key (owned by root)