When using GnuPG to sign a file, one usually uses something along the lines of:
gpg2 --detach-sign --armour <file-to-sign>
Now, let us assume that for some reasons in company X signing of releases is only possible on a remote machine. Signing involves the calculation of a cryptographic hash of the file to be signed and that hash is then encrypted with the private key. In the above company, one would have to transfer the release file to the remote machine, sign it there, delete the file again and publish the signature alongside the release file.
With large releases and slow connections, signature generation can take up hours and company X's boss does not like that, so the employees must find a faster solution.
The fast solution is to calculate the cryptographic hash of the file locally and pass the hash to the remote machine to make a signature using this hash. The idea would be to use something like:
gpg2 --detach-sign --armour --input-is-ALGO-hash <hash-for-signature>
But, how would you do that in a way that makes the resulting .sig file indistinguishable from one generated by GnuPG calculating the hash and signing it? Are there any disadvantages to this security-wise?