You can read more about GnuPG at their web site.

The site.xml that can be deployed alongside parent POMs was originally attached to the project in such a way that the GPG Plugin could not get hold of it. To enable signing of the site descriptor, you need to update to Maven Site Plugin 2.1.1+ which contains the required fix (see also MSITE-478).