You can read more about GnuPG at their web site.
site.xml that can be deployed alongside parent POMs was originally attached to the project in such a
way that the GPG Plugin could not get hold of it. To enable signing of the site descriptor, you need to update to
Maven Site Plugin 2.1.1+ which contains the required fix (see also