I have recently been introduced to GPG signing as a better way of verifying data than hashing. It was described that if you posted the hash of the file, someone could hack your website, alter the hash and publish a different binary and you'd be non-the-wiser. GPG signing was a way to overcome this. I'm not entirely sure I understand the reasoning behind this.
For example, if someone were to hack your website, what is stopping them publishing a different public key registered with the same name/email as the previous key? Of course the date of the signing would be different, but how would you realistically know what it should be? This leads me to say why bother going through the process of using GPG for this purpose when hashing is much simpler? I must be missing something here as I see this practice used for large projects, e.g. SDL2 and libuv