release: don't try to sign .tar.lz files