Checksums and signatures have different purposes.
Checksums are good for verifying data integrity. They verify that you have received what you expected to receive. I would not recommend CRC32 or MD5 for verifying file integrity - use SHA256 (
sha256sum on Linux,
shasum -a 256 on OSX) instead. CRC32 and MD5 both have a large enough number of collisions, and CRC32 is particularly vulnerable to brute force (we were cracking CRC32 back in 2000s to make cheats for GunZ!) that it's not reliable to verify file integrity, IMO.
Signatures are useful for verifying data integrity and that the file originated from a given source. They are useful when you need to ensure that not only was the data not modified, but it also came from a specific individual or group of individuals. Example uses would be the distribution of software from an app store - Signing the app before you send it to your app store ensures Acme App Store hasn't modified the app contents, and Acme App Store can be sure that the binary came from you, not just someone who guessed your API keys for uploading.
The caveat with signatures is that they require some shared key material, and often those keys can expire. Verifying the signature of a file is also more tricky. Checksums only require a simple file be hosted somewhere, and verifying the checksum can be done visually or by comparing two files.
If your firmware is being flashed onto an IoT device before shipping it out, I think a checksum is probably fine - although, if it's flashed on an IoT device (and you control that flashing process), you probably don't even need data integrity.
If the device is reaching out to your website directly, and youre hosting the patches, a checksum is probably fine. However, if you're using an intermediary, you probably want a signature.
You are correctly though that, if a machine is doing all the work, you probably don't need to have both a checksum and a signature, as the signature will perform the checksum for you. However, as other commenters have mentioned, it can be useful to have a checksum if humans will be involved, as verifying a sha256sum is typically a lot easier than verifying a binary is signed correctly for a human.