Verify downloaded binary

[findmyname666]

It is a good security practice to "verify" downloaded binaries from the internet.
Therefore please add functionality to check the binary checksum.
For example plugin for Terraform does it.

[looztra]

Good point, but from my understanding, the hashicorp plugin can do that securely as hashicorp provides a signature that can be used to verify that the checksum file is the one expected.

We could verify that the downloaded file matches the sha256sum provided, but I assume if someone would spoof the downloaded file, they would also spoof the sha256sum file.