Right now we explicitly need to set sign: false in the source-build VMR legs. We should make this the default for source-build so that we don't have to set that parameter.

Example: https://github.com/dotnet/sdk/blob/1c88a979b7109d83e5317b0e374c8d13ef2b3b68/eng/pipelines/templates/stages/vmr-build.yml#L103

cc @mmitche @MichaelSimons