4 ms·

So then what? Am I supposed to connect to multiple servers, one for SHAs and the other for blobs? What is the point of that? To be fair, by this point in the

• jessaustin 11y ago
  Checksums can be simply listed on TLS-enabled websites, or in PGPed emails, or whatever. They don't need to be on CDNs, which in many cases would be indicated for software distribution. The other thing to keep in mind is that a checksum can certify the entire distribution process, from a packager's personal machine all the way to your hard drive. TLS only proves that no one eavesdropped on the connection between your client and whatever machine claims to be the CDN, which for software distribution is pointless and unhelpful.