For anyone coming to this later, digests are not presented in a super-understandable way (there's a good explanation of them in this stack-overflow). There appears to be two ways to get the digest that matches the one on the DockerHub page for the tag:
- pull the image (what I was trying to avoid)
- use API 2 (requires a token)
There's a good discussion of options for finding out if images have been updated in this r/SelfHosted discussion which is what I was trying to achieve.