... Let them handle security for you, since you are unwilling to learn. SHA-256 checksums are pretty much pointless. If someone breaks into the website, you think they're going to upload a modified version of Anoncoin, then forget to run sha256sum on it? With a GPG key signature, I'd have to either be Meeh, or break into both the web server and Meeh's system, steal his private key, then kidnap Meeh and make him tell me the password to the key.
...