Yes, but the problem is many of them don't even include the hash, and you also need a way to verify the creator and his/her public key.