It's "easy" to do it right but also very common to do it wrong: https://jacko.io/tree_hashing.html