pom.xml: ensure artifact only signed if performRelease=true