See [wiki:"how-to/puppet/sign-release"].