Add note that we don't sign gems or os x packages