update readme to mention that we do not allow verification of jar signatures