Earlier quoted context omitted.
> The number of people who religiously check PGP signatures/SHA256sums or whatever is miniscule. • If you transfer things around using BitTorrent, it'll ensure you always end up with a file that hashes correctly to the sum it originally had when the .torrent file was constructed. • Many archive formats (zip, rar, and 7z, at least) contain checksums, and archival utilities validate those checksums during extraction, r…
Both macOS/iOS and Windows use code signing for executables, which should guard against most types of corruption. Web pages (and anything else) transmitted over HTTPS are protected from corruption in transit by TLS's hashing (which is vastly stronger than the checksums at lower levels of the network stack), though that doesn't help if the server has faulty memory or storage. PNG has built-in checksums, though other i…
I didn't bring this one (or any other transport-level checksums) up, because we were talking about whether you can trust something "across the whole process"—from its origin developer's disk (where it might get an initial explicit checksum generated), to origin memory, across the network to a server's memory, to that server's disk, over the network again to a CDN reverse-proxy's memory, maybe its disk, then the network again to you, then your memory, your disk, and finally your memory again as you verify it. Oh, and a bunch of routers and switches in between, of course.
Static checksums that are baked into file formats or manifest files protect the file across that whole chain. Transport-level checksums only ensure that the one part they're involved in happened correctly.