What is the "Payload Hash" in koji?
It looks like an MD5, but of what? It's not the rpm... I've checked.
Should koji be providing verification hashes for manual downloads of built RPMs? I think this would be useful for testing.

http://koji.fedoraproject.org/koji/rpminfo?rpmID=8351409