How do I verify my firmware is legitimate?
IMO, your firmware is original, because it


Received OTA - most clinching reason ( see edit for details)
Knox isn't tripped
Firmware number matches 


For Samsung phones, there is a handy app that provides a lot of information about the phone, including Refurbishment Check. It also shows if the device is original. It is Phone INFO Samsung. App developer thread on XDA here

This question shows you to verify the checksum of OS. You could try that with the checksum available on OEM site or SamMobile Is there a way to verify stock ROMs?

Edit

Starting from Android 5.0 Block based OTA, in which the device can get an OTA when the entire /system partition matches with that does on their servers. Concerns of OP in comments are addressed here- if the system is modified OTA would fail


  ....File OTA tolerates some changes to the partition, such as the addition of files that are not part of the source or target build. However, block OTA does not tolerate additions to the partition, so users will need to install a full OTA overwriting any system partition modifications) or flash a new system image to enable future OTAs


(Emphasis supplied)