Who cares about ssl when your country's spooks are running their own modified Bind servers (dns) having hacked your ISP switches routing you net traffic to their own look-a-likey servers where you think you are buying an ssl cert from a CA, or you are downloading a distro like tails or ubuntu from their own servers.

Hashes are useless if you have downloaded compromised software/distro/what have you from spook servers. Just hash the compromised software, the unthinking will see the hashes match but not realise what has been downloaded is already compromised.

It pays to plan decades ahead.