It feels a little opaque that passing in an options.hash means it's checked, not passing it means no check -- since in other similar cases like passing options.stat to `readFile()`, the passed value acts just as an optimization.  Maybe name the hash option something like 'requireHash' or 'expectedHash' instead?

(I'm happy that this is using `hasOwnProperty()` to check for the hash btw -- if anyone intended to verify the hash but accidentally passed a falsy value, they won't accidentally get a blind write as a result!)