Glad to see that there's a `--verify-sha256=` flag. I prefer hard-coded hashes in my code so that when the file changes, I'm made aware. I've lost so much tim

Glad to see that there's a `--verify-sha256=` flag. I prefer hard-coded hashes in my code so that when the file changes, I'm made aware. I've lost so much time chasing bugs back to a dependency which changed without a version bump and whose hash was checked by a script that just got the hash it was checking at runtime.