Thanks for the detailed answer. I see why MD5 is harmless here, now.

I still wonder why anyone does anything with MD5 anymore, especially in an application like GPG... if it is known to be weak... It makes the argument why it is still safe in this situation much more subtle and involved. From all the crypto gurus, we hear 'MD5 is unsafe, do not use it anymore!!' and then in PGP/GPG, MD5 is still used because, well apparently for historic reasons and because one can. As a non-expert in these matters, this looks very odd. It seems to (needlessly) make matters more complicated and involved, more complex in terms of the necessary analysis, and on the other hand unnecessary complexity is (rightfully) despised by the same security people...

If they'd use SHA256 or similar, one could simply assume all of the properties of an unbroken cryptographic hashing function and throw out the MD5 code.

So in the end, the only valid excuse here would be history+inertia.