add “sign” target to makefile

We’ll be shipping GPG signatures along with releases from now on,
mirroring Luaotfload:

        https://github.com/lualatex/luaotfload/commit/2cd6d7aab3687bbfc43f1fc82da626b8c9395f27