Etcher has supported already for few years extracting the image from the zip on the fly as long as the zip contains only one file, like is the case here. Therefore, there shouldn't be any real reason to unzip first. I also think you should take the checksums from the zip file itself since that's essentially the release you are distributing. At least I see it so that the checksum can be used to validate that the release is indeed what it should be and not something that has been replaced with a botnet addon. That's why the checksum should be of the distributed file instead of a file within it. Zip by itself will anyway create an internal checksum of the file and extracting it will fail if the file has been somehow corrupted during transfer. If you'd want to go the pro way then signing the release file with gpg would be the way to go. 

Few comments regarding the release itself, less than previously thanks to fixes:

• the login screen password input field still doesn't grab keyboard focus automatically on page load
• serial-getty@ttyS0.service is still active and constantly trying to start and failing to do so
• /var/log.hdd could use a cleanup before release
• documentation for front led blink signals is missing from the first post, I've seen at least slow yellow, fast yellow, slow green and irregular red