Oh, sure. But as the installer is signed, instead of checking against a changing checksum, you can just verify the signature certificate, which is much simpler.

The trust path should be: "DigiCert" (the root CA) -> "DigiCert Trusted Root G4" -> "Verokey Secure Code" -> "Pierre Marie Baty"

All the executables are signed to prevent antiviruses from scaring out the users. Ethically I consider this "requirement" as an organized racket against individual developers, but whatever.

Additional note : the certificate I use changed in early 2024. The old one expired and I changed to another provider because the first one proposed to renew my cert for thrice the initial price. My previous certificate was issued by a bulk reseller of Sectigo (Comodo). So if you look at installers from 2023 or earlier, you’ll see a different trust chain, but still my name at the end.

Indeed I wish Let's Encrypt could issue those so-called "Microsoft Authenticode" certificates. That was their ambition a few years ago. We're still waiting but it looks like it's not as simple as it sounds [insert the conspiracy theory you want here] :-(