It's not really in the spirit of the change. I think changing the default is good, but in my fix within our internal "fork" we always verify the hash because the Authenticode check isn't good enough if an *end user* screws up and puts a layout in the same location as another bundle with validly signed packages.

Perhaps in addition to these changes, the code change to always verify the hash should be made. If the default value of "yes" is set to "no", the bundle will check the hash twice (effectively), but the hash check should always be done.