Signature and checksum files in releases?

[Nick Dimiduk]

I'm looking through our past releases on a couple mirrors -- none of them
include checksum or gpg signature files. How have we gotten away with this?
Do we post these files somewhere else?

Thanks,
Nick