docs: Update documentation on signing netboot artifacts.

The previous instructions did not properly expand the the artifacts, leading to no new or bad signatures, as gpg does not accept multiple files to sign that way.

README.md

@@ -155,7 +155,9 @@ key](https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/wikis/home) is
 created for each file:
 
 ```
-gpg --sender "User Name <[email protected]>" --detach-sign sitestatic/netboot/*.{efi,ipxe,lkrn}
+for artifact in sitestatic/netboot/*.{efi,pxe,lkrn}; do
+  gpg --sender "User Name <[email protected]>" --detach-sign "$artifact"
+done
 ```
 
 # Production Installation