use java gpg implementation

[cvogt]

http://mvnrepository.com/artifact/com.jsuereth/gpg-library_2.10
https://github.com/sbt/sbt-pgp/blob/v1.0.0/pgp-plugin/src/main/scala/com/typesafe/sbt/SbtPgp.scala
https://docs.oracle.com/javase/tutorial/deployment/jar/signing.html

[cvogt]

I am not sure how urgent this is, maybe not much at all. But currently CBT uses the gpg command line tool for signing. MAy eb good to use BouncyCastle instead, if there is a simpler way (ideally one-liner) than all the stuff SbtPgp does

[cvogt]

one more thing you might want to take a look at @rockjam :) actually I am not 100% sure it is actually better to use BouncyCastle instead of command like gpg, but it is worth considering. I think @mchav took a look at this one as well somehow. Maybe we can share your findings / status. Best would be integrating with local gpg agents / keychain on OSX