We check their hashes anyway, but hey, why not. And anyway, otherwise
this curl command doesn't work (unless one adds --location to honor
redirect — to HTTPS — headers).