If you can switch between the images, you can also switch hashes. Without a sign...

pgeorgi on Feb 23, 2017 | parent | context | favorite | on: Announcing the first SHA-1 collision

If you can switch between the images, you can also switch hashes. Without a signature they serve _only_ for making sure the network didn't barf into your stream.