v0.9.1 tag built and output signed. appears to pass sanity tests.

pullreq for my gitian sigs. gverify behaves weirdly and does not often correctly report a mismatch. eyeballing the important objects shows a hash match; gverify insists this is OK along with the other older-yaml form .sigs too, including gavin's.