The optional XBPS publisher signs repository metadata after package signing. Remove the runner key only after publication and release asset upload.