use hashes to check file integrity instead of gpg