When you check the hash value, you have to check it against a reference hash value: this does not solve the problem, just moves it around. You still have to make sure that you got the correct hash value. If the hash value is obtained through the same channel as the software package (i.e. you both got them from a HTTPS Web page), then you have gained nothing against attackers: if the attacker could alter the package, then he could also recompute the hash and alter the hash value you obtain so that you would not see any problem. Typically, someone who hijacks the download server itself.
Hash values "alone" are good at detecting random transmission errors (e.g. a router with bad RAM), not intentional alterations.
Digital signatures offer an enhanced service: they link the package to the individual who produced it, regardless of intermediate servers. With a GPG signature, you can download the package from a shady mirror site and still do not have to fear the package being bugged.
As for performance, know that signature verification will have the same cost as computing a hash, plus an extra mathematical operation which even an asthmatic PC should be able to do within a few milliseconds. I seriously doubt you could actually observe that extra cost.