Actually never mind, forgot the verifyManifest code is what parses the manifest object in the first place, that is why it is after.  It just ensures there are no size inconsistencies in the manifest, which would indicate a client gave a bad manifest. 