I know given the thread this is in makes it ironic, but a public blockchain would actually serve as a pretty good place to keep a check sum ;p You would check the official blockchain address for a repository and know that the checksum there has not been modified. As long as the process of creating the transaction is done correctly.