Fix broken `gpg sign`

+ Only generate GPG manifests for appliances that have changed
+ Revert arg expansion that broke if `$signkey` was not used