add `download` attribute to download links

This makes browsers always prompt to save the file. The signature file might otherwise be shown by the browser instead (for me at least when running hugo serve locally).