Right now, updateZipTask will build the APK then include it in the ZIP.
That happens on the buildserver.  The signing is separate, so this is
tricky.  I can think of a two approaches:

1) the org.fdroid.fdroid.privileged.ota just downloads the
   org.fdroid.fdroid.privileged APK and includes it into the ZIP

2) when publishing the update.zip, the signing process extracts the APK
   from update.zip, grabs the signature from the
   org.fdroid.fdroid.privileged APK, inserts it into this APK, then puts it
   back into the ZIP

This is the first approach to getting the official OTA update ZIP created.