binary verification. A check that a whatever is downloaded cannot exceed it's capabilities.

That's already handled by the sandbox.