How does the browser verify that the md5sum is correct? The server would have to send the md5sum to the browser through SSL, which is good enough to protect the download anyway.