Hacker News Reader

You can calculate the signature offline on your local machine against the public key - only the owner of the file can generate a valid signature

These aren't signatures though? They're checksums, anyone could make them for any blob they want.