Think about it this way: if you already had a guaranteed-secure method for delivering a hash... then you don't need a hash, you could just use this magical secure delivery mechanism to deliver all the code directly -- or even your whole email message!