It is unlikely a "signing enclave"[1] will be implemented in the short
term, and rather than wait forever, we can sign with a GPG key until a
better solution present itself. The GPG master-key is stored in the
infrastructure repository[2].

[1] infrastructure#280
[2] infrastructure!579

Fix #132