Once I have installed and tested an extension, do I need to keep the md5 and dep files?
I guess the md5 file could be useful to check if the extension has become corrupted at some point in the future, but I have not kept them for downloaded extensions and have not had a problem.
You will need to keep the dep files for extensions in /tce that need other extensions to load first - eg dbus, cups - and to make life simpler to load locally from folders other than /tce. It is much easier to load the gtk2 extension (for example) if the dep file is present than to load the deps one-by-one.