Add SHA-256 hashes to website.

[vishalnandagopal]

Comparing the hash of binaries downloaded is the most common way to verify that the file has not been tampered with. I couldn't find any mention of hashes on the main website https://keepassxc.org .

The only thing I found was downloading the SHA256 digests from GitHub on https://github.com/keepassxreboot/keepassxc . While it is useful, there is no point in hashing it since the SHA256 digest might have been tampered too. Both are only protected by your GitHub account password.

KeePass (the original) hosts the releases on SourceForge and provides on hashes on https://keepass.info/integrity.html

Thank you.

[droidmonkey]

Follow these instructions: https://keepassxc.org/verifying-signatures/