This is effectively what most package managers do too. If you're going to be running code from a third party, you need to be able to trust that command, or ther

This is effectively what most package managers do too. If you're going to be running code from a third party, you need to be able to trust that command, or there's really nothing you can do, as some equivalent of it is going to run.