I removed the dependency on GPG by making the encrypted signature file optional rather than required.