Since dput targets have an "allow_unsigned_uploads" property, let's not assume that no key means no upload