and the signed hash is actually checked against the image. Of course, this is the step that is missing because it's a non-mandatory manual process. Serving th

and the signed hash is actually checked against the image. Of course, this is the step that is missing because it's a non-mandatory manual process. Serving the images directly over HTTPS would provide more security for every end user that is not manually checking signing hashes.