> How do you know which hash is the correct one? Figuring out the correct hash is different from knowing that the software you got is from who you expected it

> How do you know which hash is the correct one? Figuring out the correct hash is different from knowing that the software you got is from who you expected it to be from. If you sign 100 versions of something and you verify what you got... you'll know they came from who you expected (rather than a bad actor) but you might not know which version to run from that.