Attempt to disable publishSigned for unpublished projects

This requires re-ordering the PGP plugin in autoSettings.

This patch does not work. Not sure why.
Instead of trying to move PGP plugin just exclude it

And then add it back when needed.

This appears to work. I don't know why moving it fails.
Add PGP plugin to publish signed.

Make plain "publish" throw an exception.
Plain "publishLocal" still works so you can test without
having to do PGP stuff.
Merge pull request #255 from typesafehub/wip/havocp-backport-signing

Backport publishSigned