make it clearer that the :signing key is first-level
Merge pull request #1735 from martinklepsch/clarify-gpg-override

make placement of :signing key clearer
Merge remote-tracking branch 'upstream/master'