Matches against what? If the website is compromised the checksum can be compromised as well. If the tarball is not pgp signed by the author (e.g. Bazaar and To

Matches against what? If the website is compromised the checksum can be compromised as well. If the tarball is not pgp signed by the author (e.g. Bazaar and Tor Project do that), checking the checksum is basically checking if the server you’re downloading from didn’t have any silent data corruption (see recent KDE hosting incident), because in transit TCP does its own checksumming anyway.