Ensure a SHA2 hash algorithm is used when signing releases (#4384)
Ensure a SHA2 hash algorithm is used when signing releases (#4384)

* use gpg2

* explictly use sha256

lmcro/letsencrypt,stweil/letsencrypt,jsha/letsencrypt,letsencrypt/letsencrypt,letsencrypt/letsencrypt,lmcro/letsencrypt,jsha/letsencrypt,stweil/letsencrypt