Take Security More Seriously - Checksum by default

I believe that a default of createChecksum being false is bad practice and a checksum should always being produced.

Maven doesn't appear to have a guide so I'm looking towards the main apache guide i.e. https://www.apache.org/dev/release-signing.html