Two remarks submitted for your appreciation.
In the pom.xml file, when a key signing password contains an $, it must be escaped. Otherwise, it causes signed for debug only.
Could this recommendation be added to your documentation ?
Android Studio accepts keystore file with .pkcs12 extension for example. But the Gluon plugin makes a debug signature in this case. It seems that at least an .jks extension is needed. Could you mention in the documentation which extension(s) the plugin can manage ?