Did Gpg4win get pwned? SHA256 checksum does not match official checksum on gpg4win.org

Downloaded v4.1.0 of Gpg4win on 1/5/23 @ 23:38 EST. Ran \`certutil -hashfile \[...\]gpg4win-4.1.0.exe SHA256\` in Command Prompt and got this resulting hash:

\`e0fddc840808eef9531f14a515f8b3b6c46511977f00569161129c1dee413b38\`

However, the official SHA256 checksum listed on [gpg4win.org](https://gpg4win.org) appears to be:

\`cec8cfed0b21621c1e46cd333e573f47a1abcbf5a7f6debc4e010167a621da41\`

​

Did I make a totally noob mistake, or does this mean the executable I downloaded is not an official Gpg4win executable?

amp certutil command cybersecurity hash mistake official org pwned sha256