git-tag -s must fail if gpg cannot sign the tag.