It sounds good, but if you're distributing the hash through the same channel as the script, then it's open to the same vulnerability (MITM, website breach, what

It sounds good, but if you're distributing the hash through the same channel as the script, then it's open to the same vulnerability (MITM, website breach, whatever) > adding some sort of common utility to support it could mitigate the most obvious security issues. Package managers are awesome!