I think you missed the point regarding Tor. I mean that for Tor to be compromised, a state actor would need to compromise on the order of dozens to hundreds of

I think you missed the point regarding Tor. I mean that for Tor to be compromised, a state actor would need to compromise on the order of dozens to hundreds of nodes simultaneously. The fact that Tor works shows that they are unable to do this, and so they would also be unable to simultaneously compromise dozens of checksum authorities. Nothing to do with using Tor for uploading checksums, I was just using it as an example.