Dmg vs pgp signature meaning