use pgp-maven-plugin instead of gpg-maven-plugin for release signing