Can an .ipsw firmware restore image's origin be verified?
Given an .ipsw iOS firmware restore image, can its origin be verified (e.g. through checking a digital signature) to provide assurance that it is actually from Apple and it hasn't been tampered with?
All IPSW SHA1 hashes can be found on The iPhone Wiki - Firmware.
You can get the SHA1 of your downloaded IPSW by running the following Terminal command:
openssl sha1 <path-to-ipsw>
The output can be compared to the relevant SHA1 provided on the wiki.