Sign off and GPG-sign Git commits when releasing a package

[castelblanque]

When a new package version is released to production, there is a commit and a tag created by the script.
We should sign off and GPG-sign the commits as suggested by Antonio in this comment.