A checksum comparison can answer whether two files have the same contents under a particular hash algorithm. It cannot by itself establish who should be trusted or what an application will do after installation.
Define the comparison
A hash is useful when you have a reference value from an independently trusted publisher channel and want to compare a downloaded artifact. Record the algorithm and the exact release being compared. A matching value copied from the same untrusted page as the download adds little independent evidence.
Keep identity and behavior separate
A hash changes when the bytes change. That makes it useful for detecting a difference, but it says nothing on its own about whether the original bytes were appropriate. A malicious file can have a perfectly valid hash, just as any other file can.
Add provenance and signing context
Android signing provides another kind of evidence about a package's signing identity and update continuity. It is not equivalent to a general promise of harmless behavior. Consider the official source, the publisher's release information and the requested capabilities alongside package-level observations.
Write a narrow conclusion
A careful note says that a particular file matched a particular reference value obtained from a named source at a stated time. It does not say safe merely because a tool produced a checksum. If the reference cannot be trusted or the artifact differs, use the publisher's support path instead of overriding warnings.