The release secret now holds only the signing subkey, which
ghaction-import-gpg can't import because it unlocks the primary key, so
release-maven imports it with gpg and signs with the passphrase as
before. Same change as dnp3's.