readme; switch off jars signing by default