only gpg-sign a release build if gpg is available with secret keys

This makes it easy for people to run this script to verify the official
release build matches their build.