verify SHA1 on download

[kurin]

This won't always be possible, but we should do it where we can.

B2 doesn't store the complete file hash on large object uploads. You can add it yourself... if you know it when you BEGIN the transfer. Even through there's an HTTP request you need to make to FINISH the large transfer, there's no facility there to say "okay here's the SHA1 of the whole thing I sent you," presumably because they don't want to have to calculate it themselves to verify it.

Also, it'd only work when users are downloading an entire object. Which I suspect is the majority use case, but which is kind of unsatisfying.