Move gpg signing to profile

So that you don't need to have the keys just to build/install anything.
Also done as profile because if we just removed the <executions> it has
been observed to produce bad GPG signatures.