Add a note that the sign script should be run from the heroku app's repo

refs ryansmith/l2met#91