Usually, it's in the ZIP-Archive... but I managed to have it broken after putting it online (the image was too small on my PC), so the md5 was correct for the broken image...
I'll make a redownload and reflash check from now on before putting an image public.
I can put an md5 of the ZIP archive online, if you want though.
I assumed that it wasn't in an easy to find place or people would have checked prior to flashing but I guess they did check. As long as the md5 is around somewhere easy to find I'm happy.