Hashes are good but it’s already time to start doing gpg-signatures to tarball. Suffice it now to hack the site or even deception to obtain control over the wiki, put “fresh” version of the client and everything collapses.
Re: (context post by bitcoinex)
Figures: bitcoinex