Installation images use vulnerable hash algorithm

[9gay]

https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

Alternatives:
SHA-2
SHA-3
BLAKE2
BLAKE3

Recommendation:
For really paranoid users there are easy to use minisign and signify tools to check for intentional tampering with images and hashes, also it is not difficult to make GUI for both of those command-line tools because they are easy to use.