fix: check if we have a gpg key for signing

We already checked but only after trying to use it.

In addition Hash.merge does not alter the underlying hash but returns a new hash instead. So we have to return that new hash from the add_sign_options function rather than the old one.