bumping is fine, I like that one. This replaces the publish pgp with `publish-signed`.