It sounds like perhaps you have downloaded the installer.dmg itself and not the full .pkg file that would have the certificate. What happens for example if I downloaded El Capitan today from the App Store is I would get a .pkg file with data inside that file identifying that .pkg as having been downloaded with my AppleID. And that .pkg file would have the certificate mentioned.
Then inside that .pkg file is the installer.dmg. That file is the same for everybody and would have the SHA that matches other downloads. That installer.dmg is not linked to an AppeID.
That sounds about right. Thanks for the explanation.
[doublepost=1468935713][/doublepost]
Not sure if it helps, but this is the results for the last download I made on July 6, 2016.
View attachment 640761
I got:
eebf02a20ac27665a966957eec6f5e6fe3228a19
But, the only version I could find was 10.10.2