fix up publishSigned configuration and ban plain publish