If your public key on your website is hacked and your hash is on the website, well, your hash will be hacked too.

If you're going to transmit the hash via a secure side channel, just transmit the public key.

I think the author is confusing secrecy with authenticity. The only way to prove the public key you received is really the intended public key is with a third party certificate authority that authenticates it. Which is what TLS does.

But I will assume the author is smarter than me.

Am I missing something or is this article useless? Just use the same secure channel for the hash but for the public key.