That's md5 and sha256 hashes, not a gpg signature.

There's a world of difference when something is unsigned because it's impossible to prove that it was what the developer(s) signed off to release.