If you're the entity who created the image you can retain the original hash and verify it against the downloaded copies. But that kind of defeats the purpose of being able to download docker images across distributed hosts.
They'd really need to be signatures attached to the images, not just hashes.
They'd really need to be signatures attached to the images, not just hashes.