One additional detail on why it was done like that: most packaging procedures expect so sign while the package is being created, but we wanted to keep the signing keys in a separate place