To verify the download package, it would be great to have a checksums file with the release artifacts.