Ok, that was my own fault. After some thinking, I realized that POST-processing means AFTER Hugo runs 
I had post-processing of JS (minification and concatenation) enabled on Netlify and that, of course, did change the hash of the file. Which basically just proofs that SRI works
4 Likes