Many thanks again for you help and providing the info!
And yes, I should definitely insist on signed checksum in the future.