Codesigning via GPG-signed project manifests