What I meant is that if it has to be sent outside of the protected stream, it could be also exchanged with mitm. Unless the hash itself is somehow related to the stream in a visible way. That kind of implementation complexity, rather than the signature/hash complecity.