I guess one would generally be safe with a known hash, but ROM hacks would be dangerous territory.
Isn't Project64 on version 3.X now, though? A quick glance at their webpage suggests that they are, and I only noticed download links as far back as 2.X.