build: enable package list signing by default