You're still downloading random stuff from the internet. A vulnerability in your package manager could let an attacker bypass the hash check, or they could disc

You're still downloading random stuff from the internet. A vulnerability in your package manager could let an attacker bypass the hash check, or they could discover a hash collision. If you really want to be sure, having the exact bits on a system you control seems like the right move.