Major Description
The various 'dist' target implementations don't consistently checksum targets, and none sign them. Before distribution on Apache servers, all artifacts must be signed.
We should add a new command, 'sign' that signs and checksums all artifacts in dist/. And we should remove all the existing per-language checksumming code.