[hawski]

Wouldn't it be easier for said third parties to just distribute changed checksum?

[noselasd]

Then it would also be trivial to discover if you go and look up the sums at the official site.