Your approach tackles the scenario that the actual shell script `https://www.tillberg.us/c/blah/gut-1.0.3.sh` https://www.tillberg.us/c/blah/gut-1.0.3.sh` might

Your approach tackles the scenario that the actual shell script `https://www.tillberg.us/c/blah/gut-1.0.3.sh` https://www.tillberg.us/c/blah/gut-1.0.3.sh` might be untrustworthy, but the whole command including the verification hash will most likely also be downloaded from `tillberg.us`. If `tillberg.us` is malicious you assume that both the gut-1.0.3.sh file and also the hash in the curl command will be changed. So I think your idea only works when you reference files hosted with a third party but decide to trust the guy who gives you the hash. Basically all occurences of curl to bash piping I have seen in the wild are of the former type, so I really don't think this helps much.