Getting an unverifiable iso for Windows seems like a bigger security risk than Recall tbh. Does MS publish hashes for the LTSC versions to at least let you ensure what you have hasn't been altered?
Be sure to check the hash with the link provided in comment from dartharva's. Hint, it checks out.
There are also unofficial MVS dumps like here: https://awuctl.github.io/mvs/