title: MD5 vs GPG signature
body: <p>According sites like <a href="http://www.apache.org/dev/release-signing.html" rel="nofollow">apache</a> signing a file (generating a checksum) using GPG is more secure than plain old MD5.  I don't understand why most people use MD5 instead.  Can some explain the real differences in plain technical English? </p>