Cleatext signing (having the signature and data in the same file) is broken in many ways. It is possible to put unsigned data at the top of the file in a way that sha256sum will use it. Watch the 39c3 GPG talk if your interested in the gory details.

The solution is to use detached signatures (checksum.txt and checksum.txt.gpg to verify that). This makes sure that all of checksum.txt is actually covered by the signature.

Sounds like it… https://blog.fermi.chat/blog/2026/04/26/theFuture/

That is, by far, one of the saddest pieces of text I have read in a while.