Verifying a commitment yourself

Take the revealed pick text, append the revealed salt exactly as published, run SHA-256 on the result, and compare the output to the hash that was posted before the event.

The whole value of the mechanism is that it requires no trust. If verification depends on the publisher's own tool, the publisher is still the authority, and nothing has actually been removed from the chain of trust.

The exact format of the string matters — spacing, ordering, whether the salt goes before or after. A scheme that does not state the format precisely cannot be verified even in principle.

Which is where it goes wrong. A publisher who provides only a verify button has rebuilt the thing they claimed to remove, and it looks more convincing than a plain instruction would.

What to do with it. Verify one pick manually, once. If it matches, the mechanism is real; if it cannot be done at all, treat the scheme as unverified.