Comment # 2 on bug 952372 from Stephan Kulow

they are gpg signed sha256 sums. And they were broken for RC1, but for GM it's
perfectly possible to feed them into sha256 -c *and* gpg

But yes, the text about extra signatures on software.oo does not apply to leap