ftp.gnu.org has been compromised since March 2003. The history and a list of steps taken to fix things is in their MISSING-FILES.README. They have a resolution for all future file uploads:
All releases after the 2003-08-01 date will have checksums GPG-signed by
the GNU maintainer who prepared the release. This assures automatic
certification of the integrity of all GNU source from that date onward.
Smart!