Use real gpg secrets for testjar in release profile

testjar/pom.xml

@@ -57,6 +57,7 @@
                             <goal>sign</goal>
                         </goals>
                         <configuration>
+                            <!-- use non secrets for testing -->
                             <keyname>70840C24899FD4CB</keyname>
                             <homedir>${basedir}</homedir>
                             <passphrase>secret</passphrase>
@@ -73,6 +74,31 @@
         </plugins>
     </build>
 
+    <profiles>
+        <profile>
+            <id>release</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-gpg-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>sign-artifacts</id>
+                                <phase>none</phase>
+                                <goals>
+                                    <goal>sign</goal>
+                                </goals>
+                                <!-- Easier to use real secrets in release profile -->
+                            </execution>
+                        </executions>
+                    </plugin>
+
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
     <dependencies>
         <dependency>
             <groupId>com.google.code.findbugs</groupId>