Make signing of gpgpass optional.

The authenticode signing rules have no knowledge on which packages are
actually build and thus we need to move some package to the optional
part.

Should be fixed in some better way.