Thanks! So if I do make a signature using GPG, it might still silently sign just an MD5 digest, if I didn't (re-)configure it properly? That sounds scary...