Someone needs to have verified the decrypted file hash before. Could be the merkle root of a torrent file for example, or some other well-known data (like the Blockchain).