Sign checksums, not files.