Re: digitally signing a distribution package