Using solely the hash of the files as a validation is insecure. There is a reason why Bitcoin Core hash sums are included within a PGP signed message and users are encouraged to verify them first before trusting it.
This is exactly what I said. To upload a signed message containing the hash instead of leaving a hash solely.