Signing changes for promotion workflow

Various changes to signing we need to enable the automated promotion workflow for PE packages. These include - don't kill the keychain/gpg-agent when we start signing, since we're going to use the existing one, and specifying --no-tty and --use-agent to gpg when we sign. The best is passing gpg arguments down through debsign to accomplish this. That one is pure debian.