use the gemspec as the source of truth.
Give signing files more precise names

There's nothing worse than pem files with generic names.
v0.4.6