address pr feedback

- Fix intro sentence to use active voice
- Remove "on Linux" qualifier from curl example
- Make section headings consistent with numbered list
- Add section for optional SHA-256 checksum verification

Author: ltclm

download-data/stac-api/large-assets.md

@@ -4,13 +4,13 @@ Assets larger than **50 GB** cannot be downloaded with a regular HTTP `GET` or `
 
 The workaround is to use **HTTP range requests**, which bypass the CloudFront limit by fetching the file in sequential chunks directly from the S3 origin.
 
-The actual download is completed in this steps:
+Downloading a large asset involves three steps that we detail in the following subsections:
 
 1. Probe the asset
 2. Download the file in chunks
 3. Optional: Verify SHA‑256 checksum
 
-## Probe the asset
+## 1. Probe the asset
 
 Send a `GET` request with the header `Range: bytes=0-0` to probe the asset.  
 The S3 origin responds with `HTTP 206 Partial Content` and includes two useful headers:
@@ -20,7 +20,7 @@ The S3 origin responds with `HTTP 206 Partial Content` and includes two useful h
 | `Content-Range`     | `bytes 0-0/<total_size>` — the total size of the object           |
 | `x-amz-meta-sha256` | SHA-256 hex digest of the full object (when set by the publisher) |
 
-Example to probe an asset manually with `curl` on Linux:
+Example to probe an asset manually with `curl`:
 
 ```bash
 curl --silent --show-error --location \
@@ -43,7 +43,7 @@ x-amz-meta-sha256: <hex>
 `HEAD` requests are **also blocked** by CloudFront for objects > 50 GB. Always use `GET` with a `Range` header to probe asset metadata.
 :::
 
-## Download
+## 2. Download the file in chunks
 
 The script below requires **Python 3.6+ and no third-party packages** (stdlib only). It works on Linux, macOS, and Windows.
 
@@ -301,6 +301,12 @@ if __name__ == '__main__':
     main()
 ```
 
+## 3. Optional: Verify SHA‑256 checksum
+
+If the asset publisher provided a checksum, the download script automatically verifies it after the download completes. The expected SHA‑256 is read from the `x-amz-meta-sha256` response header during the probe step and compared against a hash of the downloaded file.
+
+If the values do not match, the script exits with an error so you can detect a corrupted or incomplete download before using the file.
+
 ::: tip Parallel Downloads
 The script above downloads chunks sequentially, which is simple and reliable. For faster downloads on high-bandwidth connections, you can parallelize by downloading multiple chunks simultaneously using threads or asyncio.