A server that redirects to a place to download a file, could redirect to something that has become malicious. However, if the server redirecting provides a checksum of the expected content that will be downloaded as part of following the redirect, we can protect ourselves against that.
In the sysand-index, I added a RFC 9530 / Repr-Digest with checksum following redirect. I figure when the client follows a redirect to download from object storage, it should respect that header's provided checksum and verify that the downloaded .kpar has a matching checksum.