Where is this official list? A quick google search just returns forums which seem to conclude that these are no longer published by MS.

There are some dumps online like https://www.heidoc.net/php/myvsdump.php or https://sha1.rg-adguard.net/

The issue about verification still remains. We have no way of knowing if these haven't been tampered with as well. If a malicious actor is tampering with ISOs on a large scale, they will make sure their tampered copies have the most seeds and their fake checksum lists will be at the top of search results.

find a friend with MSDN access (or whatever it's called this week), the digests are all in there

(they used to be public)