Why cant we hash libraries and trusted parties publish security checked hashes?