Generally the solution is to get signed checksums. This comes with the usual issues of how you verify the key used to sign.

Alternatively try and distribute the checksums out-of-band. So an attacker would need to MitM two channels.