This API is used internally correctly and externally mostly correctly
but #6230 reveals the external usage is fairly confusing and a bit
unsafe by default. Preserve the existing API while verifying the
checksum by default and providing an opt-out. Using the existing, safe
method will result in a double verification of the checksum which is
harmless. A Homebrew/homebrew-core PR will follow shortly to address
those cases.
Fixes#6230
3cfb028e7f