Because a self referencing compiler could build rebuild Trojans from the first iteration of compiler without it being detectable. You run your sha sum line to check that it matches the signed version and it looks fine, but that's because no one knew there was malicious code in it from the previous compiler. Im probably saying this wrong.