Sign releases with GPG key