Only hash after getting a file, and before using it.