*headdesk* *headdesk* *headdesk* So since commit 22144afa8d, Nix hasn't actually checked whether the content of a downloaded NAR matches the hash specified in the manifest / NAR info file. Urghhh...
22144afa8d