Is it still true if you drop "By default" from "By default, a Bundle will use the hash of a package to verify its contents."? IOW, we always verify the hash and can optionally not verify the signature. Or is there ever a case that Burn verifies nothing?