in src/main/java/org/apache/maven/plugins/gpg/AttachedSignedArtifact.java [285:298]
public Collection<ArtifactMetadata> getMetadataList() {
List<ArtifactMetadata> result = new ArrayList<>(delegate.getMetadataList());
for (ArtifactMetadata metadata : result) {
if (signature.getKey().equals(metadata.getKey())) {
// already signed
return result;
}
}
result.add(signature);
return result;
}