That stuff (checking hashes, etc) is currently mostly theatre because, as you say, a nation-state can easily serve you different hashes to check.<p>But it&#x27;s pretty easy to imagine a feature where, similar to cert-pinning, many clients report the hashes that they see on the website and if you see something different from what everyone else does, you know something is wrong. It wouldn&#x27;t need to be a &quot;techie&quot; feature - it would simply show a package as broken and refuse to install if it wasn&#x27;t verifying, etc.<p>And the goal isn&#x27;t some impossible 100% security, the goal is enough security to end mass interception and make the government rely on warrants and targeted tactics again.