Hash Mismatch

[denelon]

We're still seeing a lot of hash mismatch errors.

We've had a couple of proposals to minimize the impact.

#714 Use of installer hashes causes frequent errors. Instead, rely on signatures in binary.
#870 Provide mechanism to report SHA256 mismatch
microsoft/winget-pkgs#10782 Trigger manifest validation/update on client reported hash mismatch

This is most often caused by packages distributed by a "vanity URL" that doesn't change. The problem is exacerbated by CDN rollout.

What other suggestions do you have?