Use publish-signed

From what I understand, the sbt pgp plugin as of v0.8 does not sign artifacts with publish. Instead you should use publish-signed if available.