Sign the releases with GnuPG

[ariya]

The source tarballs and binary downloads should be signed with GnuPG.

This is especially important, given that phantomjs.org is not served over HTTPS and PhantomJS cannot be built on older or low-end PCs. In other words: at the moment, prospective PhantomJS users with older or low-end PCs are forced to trust an un-signed binary downloaded over plain HTTP.