Address "Signed release" check from clomonitor

[toddbaert]

see: #83

│ Security / Signed release            ┆      ✗     │

We think this is because the github release only includes source archives and no signed jars. We DO indeed sign jars pushed to maven central, so likely this can be resolved several ways. If possible, the best would probably be to attach the jars (even though they are published to maven).

cc @justinabrahms

[justinabrahms]

We've just fixed the tool to allow us to explicitly disable this check since we solve it w/ maven.