treewide: rework GPG signing