What is the difference (in terms of security strength) between checking a package' integrity using pgp and hashing functions (i.e. sha256)?
Isn't pgp less secure as the verifier must trust the public key advertised by the public key directory (thus being prone to mitm attacks)?
OpenPGP also hashes the package content's, but additionally cryptographically signs the hash.
A simply hash sum only allows to detect transmission problems. It does not allow to detect attacks, at least not as long as the hash is not verified through some secure channel.
Given the signer's key was validated and is trusted, OpenPGP provides such a secure channel and allows to verify the package's origin in addition to detecting transmission errors. There are different ways to validate an OpenPGP key, but simply fetching a key from a key server should never be considered one.
The hashing function is used only to check package integrity for transmission errors (which is done by verifying its checksum). It cannot provide any way to authenticate the maker of the package.
PGP can be used to verify the signature of the package (or of any other piece of data) over the maker's public key, hence certifying its provenience.
