Is it possible to get the md5 hash of Craft's latest version from the download server?
Currently not, but that's not a bad idea and probably worth adding to https://feedback.buildwithcraft.com.

During an auto-update, the file name of the patch file that is downloaded happens to be the MD5 sum of the file so the Craft client can verify the integrity of the downloaded file, but there isn't a mechanism like that in place currently for full Craft downloads.