So there are 2 things we want to protect against: 1. Attacker tampering with the data 2. Attacker learning what the user is watching For 1. as I said the eas

So there are 2 things we want to protect against: 1. Attacker tampering with the data 2. Attacker learning what the user is watching For 1. as I said the easy way is to distribute the torrent file through an authenticated, verified connection and then use that torrent file to get the raw data. Anything that doesn't hash to a piece in this torrent file is considered garbage. For 2. that's an issue I didn't have in mind, and as long as the attacker can sign-in they can match an exchange with a database of hashes, so it's not protected in this regard.