add notes on gpg/reprepro signing