Fix signing path
Verify jar signature
Make sign depend on package instead of dist

dist runs findbugs etc. which takes a long time. package is the default
target.