Comment by zygentoma

Git was maybe never intended to be used as an integrity check, but SHA hashes definitely were and are.

And if git provides a cryptographic hash over the content, I don't see why it shouldn't be used to verify the integrity of the checked-out content.