Checksums are excellent for detecting accidental corruption when the reference value is trustworthy. They cannot create that trust themselves. File and digest obtained from the same compromised page share the same failure boundary.
Use an independent authentic channel
Prefer a digest delivered through the publisher’s authenticated release process, signed manifest or another independently verified channel. Record the exact version and algorithm.
Signatures answer a different question
A verified digital signature can bind content to a signing identity under a defined trust process. HashCheck does not inspect signatures, certificates, keys or revocation and must not be used as a substitute.
Verify source and digest independently
A comparison is meaningful only when the expected digest came from a channel you already trust and names the exact file version you selected. Compare the complete hexadecimal value, algorithm label, file name, version and publisher instructions. A matching digest detects byte equality with that value; it does not scan the file, verify a signature or establish who published either input.