The verifier never fetches expected hashes from kovel.io. It reads them from the public repository below, and checks that the manifest is also in the Sigstore transparency log. Change these only if Kovel publishes a new location and you have confirmed it out of band.