Make repository signature optional

If you don't give a GPG key, then the repository will not be signed.