add ':sign-releases false' to project.clj

we are afraid of GPG signing