Defend against Cross-Build Injection with a Maven plugin that verifies gpg signatures.