Someone would have jumped out and shout that if the server is hacked,
the checksum could be modified.
BUT from a lay man user like me,
sign-ed.exe = PGP signed .exe > > file with checksum >>> nothing .
hope the develop understand that this help both parties.
thanks.