If you go to the hassle of verifying the hash, yes, that's fine. I was talking about just loading and using the page, which can be tampered with (because the hash checking happens on the gateway).