Those cryptographic hashes that sit on the same sever or are under control of the same group that publish the file itself really came about so you could verify

Those cryptographic hashes that sit on the same sever or are under control of the same group that publish the file itself really came about so you could verify untrusted copies like mirrors and CDs, not data integrity or hacks on the trusted source or a connection to the trusted source.