and the signed hash is actually checked against the image. Of course, this is the step that is missing because it's a non-mandatory manual process.

Serving the images directly over HTTPS would provide more security for every end user that is not manually checking signing hashes.