Downloaded files not verified?

I may be misreading the code, but it doesn't seem like the file contents downloaded from mirrors in lib/services/download_file.dart are verified with the annas-archive md5 hash anywhere. Since third party mirrors can host whatever they like, this is an important step to avoid handing users potential malware. Is it maybe done somewhere I'm not seeing?