I wanted to update the article to adress signing in more detail last time this was shared, but ... I'm lazy :-) I does mention it though: "Package managers are

I wanted to update the article to adress signing in more detail last time this was shared, but ... I'm lazy :-) I does mention it though: "Package managers are more secure due to checksums, signing, and auditing". Maintaining packages is a lot of work: there are many of them, all with different policies/update schedules/etc. It can be very time-consuming to maintain a package for all systems. Package managers are great, but does come with some trade-offs, like most things. There is nothing really stopping you from signing shell scripts; although I'm not sure if you'll still be able to run them with some clever "curl | gpg | sh" pipeline; but you can "curl>file; gpg [..]; sh file" it. I think very few people actually verify signatures manually anyway, not in the least because it's kinda hard to do so (gpg is a beast, although there are some better alternatives now, such as signify/minisign).