use mixlib/shellout for the sign call, so sudo env works as expected