Travis: GPG sign Linux binaries/source tarballs Since we're still deploying our Linux/macOS CI artifacts to a web server (specifically SourceForge Project Web Services) that doesn't support HTTPS, it's a good idea to sign them. But since the private key has to be checked into the repository, we use a different key for signing the pre-releases (per project policy, the private signing keys for our release binaries are never made available on any public server.)