add gpg pubkeys to start enforcing signed commits