Where WordPress file integrity checks stop working
WP-CLI verifies checksums for core and for plugins hosted on WordPress.org, and nothing else. Your custom plugins, the theme you built, and the files you hand to clients have no reference to check against. Here is how to hash them, and my doubts about anchoring digests on a free testnet.