Comment by phillipseamore

But without the source being available you still need to trust vp.net to be providing the correct hash to compare to, right?