doc: clarify distinction between sign-off and pgp-signing