But how? The manifest inside the NSP contains SHA hashes for the NROs, but that is useless since someone can simply change the manifest to match the modified NRO. Unless we have a known database of good SHAs there is nothing to compare it to.
Good NROs are signed by Nintendo, but afaik the only...