PGP signing for Maven, done right.