use subprocess instead of os.system, and gpg-sign releases
fix subprocess.call syntax