The sharp and well-informed clew pointed out to me that my formulation of an ebook-integrity scheme is missing a major chunk: a reliable third party to keep track of the hashes, so that the hashes themselves aren’t spoofed.
She’s right. I goofed. But I tell you how I’d do it, at least in the States. Make keeping track of hashes an ordinary part of cataloguing ebooks. That gives us responsible heavyweights like the Library of Congress and OCLC to serve as authorities, while not parceling out total power to any single entity.
