build: separate signing logic