If an attacker can modify the output of the curl command (on the host or on the wire), cannot they also modify the value of the hash seen and copy-pasted by the end-user? I must be missing something...