We do this for other stuff, and I think this should be no exception. It avoids me having to check hashes in [PRs like this](https://github.com/zcash/librustzcash/blob/3d39706aeeb8a1e56b65192b02c1a437796191d9/zcash_proofs/Cargo.toml#L16).