I'd like to see open source firmware too. But to the specific argument, wouldn't a reference hash of the blob and/or crypto signing be adequate to verify it's

I'd like to see open source firmware too. But to the specific argument, wouldn't a reference hash of the blob and/or crypto signing be adequate to verify it's what was delivered?