&gt; That stuff (checking hashes, etc) is currently mostly theatre because, as you say, a nation-state can easily serve you different hashes to check.<p>This is why as well as serving those hashes over HTTPS, you sign the hashes with a key, the public part of which is distributed&#x2F;retrievable&#x2F;verifiable via some other means.