This question already has an answer here:
Sometimes a website that has some binaries to download, also presents their hash keys, so that a user can verify the integrity of the binary. I suppose this is mainly for security reasons, not to check for corrupted data transfer.
However — if the binary has been compromised, isn't it reasonable to assume that the hash key provided by the web site has been also tempered with, to match the modified binary?
Why would we assume that provided hash keys are immune to hacking when we won't for binaries?