Every website using jquery will have the real hash, so you can poison all the mirrors you like and it won't matter.
The only way to get the wrong hash onto sites is to actually publish it on the authoritative server. That's not cache poisoning, that's a malicious official version.
