No, you need to verify the application itself too. That's the major problem with these scripts, you rely on the web server not having been compromised, the rel

No, you need to verify the application itself too. That's the major problem with these scripts, you rely on the web server not having been compromised, the release builder not having been compromised and you not being MITMed. Now, someone might inject nasty changes into a code repository, but it tends to be harder.