no publisher-signature check in CI or scripts
