After https://github.com/docker/build-push-action/pull/999 is merged, signing the image can be simplified with a `sign: true`.