Sign package/database automatically on adding

[anatol]

If packages/database uses signing then one needs to run gpg --detach-sign manually each time a package is added to the repo.

It makes sense if repoctl has an option to automate the signing process. i.e.

• run gpg signing for the package before adding it to database
• run gpg signing for the database after the package is added to database