> You can also modify the checksum to match the payload.

FTFY. :)

I don't know yet if these files are signed or even checksum'd. If I get to the bottom of this discussion without finding that someone has downloaded the .bin and checked, I'll hang my head and get back to the day job.