How are you going to confirm you got the correct checksum? Generally the solution is to get signed checksums. This comes with the usual issues of how you veri

How are you going to confirm you got the correct checksum? Generally the solution is to get signed checksums. This comes with the usual issues of how you verify the key used to sign. Alternatively try and distribute the checksums out-of-band. So an attacker would need to MitM two channels.