What the hashes prove
The report manifest can show that a curated report corresponds to a particular supplied source hash and that the stored curated edition has a known hash. The release manifest can show package-file byte identity. A hash proves content identity within its stated scope, not truth or authorship.