If you have the hash you don’t need to trust who the file is coming from 😉