If you want to ensure that a file is valid (untampered and came from the correct/expected source), there are two things you can do: hashing, and signing
Signing verifies two things -- that the file has not been tampered with, and the identity of the signer. If you can be sure that entity giving you the hash is absolutely the entity that is supposed to be giving you the file, then the two are equivalent. Signing and certificate authorities are a way of ensuring that trust relationship.