Private models can be checked only for consistency

For unpublished weights, the root hash appears in the attestation without the weights being exposed. Users can then confirm only that they get the same model each time ¹.