add note about PGP signing releases