If you cannot verify using signatures (like GPG; preferred!), you can use two external sources for a verification that the published hash sums have remained the same or are the same as the ones you see:
archive.org offers a historical lookup for the page
search engine caches offer you a second perspective of the page