Sign tags using the GPG key associated with the configured git email address; fix
rollback instructions and move tag-release script to new "release" subdir

Reviewed at https://reviews.apache.org/r/16941/