make gpg signing optional