Don't make it trivial to verify the hash, after all it only needs to come into play if there is an audit.