This seems to be the same problem that many open-source projects have, where the md5 hash to verify your download is at a single, (often the same) location. One possible solution would be to use Twitter pinned tweet to also announce the address, however it's questionable how many people would actually cross check.
Doesn't http have enough redundancy checks built in to make this pointless? The only time to really do a checksum isn't on a browser download, it's when you push it over some serial connection, or android adb or something else.