PGP signing M2 artifacts

[Elliot Metsger]

I got pinged by Carlos Sanchez about the 1.1.2 release.  Apparently it 
is Apache policy to PGP sign Maven 2 artifacts?

So I'm going to go and PGP sign the 1.1.2 artifacts in the staging and 
production m2 repo, and add this step to the checklist.

I think there may be a Maven way of PGP signing artifacts - there is a 
plugin and I'll look into this.

Elliot