workers only receive SIGTERM once

This ensures that workers are actually killed when
a graceful shutdown reaches its timeout. Not sure
how to test things like this, yet.