make gpg call more explicit in preparation for sign_only support