It's surprising to me how rarely even reputable companies provide hashes/signatures.
I just downloaded a Windows virtual machine that MS offers for free[1].
No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads.
(MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location)
I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO.
[1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/v...