Move package signing to msign.sh