I am having the same issue w/ this version. The hash that I calculate after downloading is 00be05ab81b8dc7ca85e32502f406a33, which matches the hash listed on the website.
Thanks for reporting this. Microsoft have deprecated SHA1 signing certificates. We have ordered a new SHA256 certificate to apply to our builds, it just hasn’t arrived yet.
As soon as we get it we will apply it to future builds.
As you have rightly discovered the hash will still match, and you can use this for confirmation. We are on it, and had planned it before the change, but our provider is holding this up.
You can track our issue here: https://github.com/OctopusDeploy/Issues/issues/2316