What are you trying to do? If this is SAML or some sort of signed auth, yeah it’s kinda really important to verify that. If it’s data that you’re ingesting, yeah you probably want to know who it came from. Otherwise anybody can send you junk data and overwrite your customer data (or whatever you’re importing). If it’s some binary blob you’re running, yeah you should probably verify that signature is signed by somebody you trust.

If you get the sha256 from the same place you got the main file, then anyone tampering with the main file could also recalculate the sha256 to match the tampered file. A signature signed with a certificate uses complex math (public-key asymmetric cryptography) to give some certainty that the signed content (the sha256) is the same sha256 that the original file author created. It’s not mathematically feasible to recalculate the certificate signature. Why don’t we just sign the whole original file with the public-key crypto and skip the sha256? Because asymmetric crypto is much, much slower than plain symmetric crypto or hash functions. It’s faster and easier to generate the valid hash or key, then sign or encrypt just the smaller key.

EDIT: thanks to all who replied. Maybe I should have written “what’s the easiest way to verify an apk file on an android phone?” Unfortunately, I guess I’m not smart enough to understand your answers 🙁