fix(1300): make GPG signing-key management delegable, and document it (#1306)