We don't need local hashes, but I would prefer the URL to the hash of the downloaded file. That way I can proof that it has not been modified.

I like the idea with the python script to update the assets. Lets do it as a follow-up.