A known local hash identifies the downloaded artifact. Remote presence verification does not prove a remote cryptographic hash. Local filesystem copies are checked against their stored hash and size.
DISCLAIMER: It did not actually take me 3 hours to build that, like people are actually asking me why I spent 3 hours on it, it probably only took 2 like damn
