It can work but the users have to be able to 'read' the code from the server and sign it themselves. Certain hashes can be considered trustworthy and that would require a 3rd party or being able to put those hashes on paper and compare them.