sign artifacts using gpg.