All three verify every file by byte count + Hub LFS sha256, use -f (a bare curl -o reports success on a 403 error body), support --verify-only, and never put a token on the command line. Payloads are on Dankclaw and verified against these manifests.
