Please sign the released eclipsegrapviz bundles. The rational is, that if unsigned bundles are included in an RCP, p2 shows the dreaded unsigned content warning upon upgrade.
If you confirm that you have access to a code signing certificate, I can create a PR with signing support for the tycho/maven build.