Hi,

the "Hash: SHA256" is coming from the GPG signature, it's unrelated to the
checksum of the sha1/sha256/md5sum (files).
There's nothing wrong in the setup, though it's unfortunate that GPG is adding
this Hash message, but AFAICS there's nothing we can do about it. Just don't let
yourself get confused by it. :)

regards,
-mika-