Thanks darksky! I tried the same steps and still compute 81c1ac553103cc0f9e123ec21168968b6c45e67c42bab8b247f3afe6e533f99a for my downloaded .img.
That helped me realize my mistake. I was computing the sha256sum of the img not of the archive.
The firmware selector sha256sum is for the gunziped image!
That indeed aligns:
I understand you mistake was checking the uncompressed file. Although rare, sometimes the downloaded file will not match and re-downloading fixes it. This is why sig files are published with archives and any good package manager will include a sig check before installing it. Anyway, glad you're up and running.