make it clearer that the :signing key is first-level
Merge pull request #1735 from martinklepsch/clarify-gpg-override

make placement of :signing key clearer