The CircleCI hack was (eventually) caught because the hash of the downloaded file no longer matched. If the checksum is hosted in a different place than the fi

The CircleCI hack was (eventually) caught because the hash of the downloaded file no longer matched. If the checksum is hosted in a different place than the file, it requires an attacker to compromise two separate systems. In the typical system, though, the hash sitting next to the file isn't particularly useful.