signed push: teach smart-HTTP to pass "git push --signed" around