One possible solution would be to use Twitter pinned tweet to also announce the address, however it's questionable how many people would actually cross check.
Doesn't http have enough redundancy checks built in to make this pointless? The only time to really do a checksum isn't on a browser download, it's when you push it over some serial connection, or android adb or something else.
But you're right about serving the data & checksum from the same source. I don't see what extra layer of security or integrity it adds. Someone tampering with server file system, or the data transfer (MitM) inherently has the access they need to inject their own MD5 into the HTML.
Furthermore it's very much possible to get corrupt data over HTTP if you have a poor connection and download a big file.
If you want a really secure "checksum" you best bet is probably a GPG signature file from a wildly distributed and trusted key.