That's md5 and sha256 hashes, not a gpg signature. There's a world of difference when something is unsigned because it's impossible to prove that it was what t

That's md5 and sha256 hashes, not a gpg signature. There's a world of difference when something is unsigned because it's impossible to prove that it was what the developer(s) signed off to release.