for file in $FILES; do
    gpg --clearsign $file
done

sha256sum $FILES > signatures
gpg --clearsign signatures