The only real way this technique can fall short is When the Formal Kali Linux personal crucial is not simply subverted by an attacker, but will also not subsequently revoked because of the Kali Linux growth group. For this technique, see the part on verification using the SHA256SUMS file. https://www.youtube.com/watch?v=9cx7PYwQZiI