docs: update note

Author: durran

README.md

@@ -36,7 +36,7 @@ gpg --verify bson-X.Y.Z.tgz.sig bson-X.Y.Z.tgz
 ```
 
 >[!Note]
-No verification is done when using npm to install the package. To ensure release integrity when using npm, download the tarball manually from the GitHub release, verify the signature, then install the package from the downloaded tarball using `npm install bson-X.Y.Z.tgz`.
+No verification is done when using npm to install the package. The contents of the Github tarball and npm's tarball are identical.
 
 ## Bugs / Feature Requests