Loads or downloads the data manifest with file checksums. Returns
NULL (with a warning()) when the manifest is unreachable and
there is no cached copy on disk; callers must treat that as
"checksum verification skipped" rather than "no checksums found".