Someone could be relying on the fact that Burn doesn't currently check the hash.  They could purposely be putting in a new file that has a valid signature but a different hash.  I don't think we can always check the hash in 3.x.