Considering the fact that gmane.com isn't secured, both are useless from a security viewpoint. It would be easier to intercept the request http://permalink.gmane.org/gmane.emacs.announce/17 and change the checksum that appears in the HTML, than to generate a new .tar.gz with the original checksum. If you can't trust that no one tampered with the checksum what good is it???