Not that it would fix anything, but wouldn't it be possible to: - Store the install script on www.xyz.com/install.sh - Store the hash of the install script on

Not that it would fix anything, but wouldn't it be possible to: - Store the install script on www.xyz.com/install.sh - Store the hash of the install script on www.abc.com/hash.dat Then in the installation command: - curl the install script from www.xyz.com/install.sh - hash it - curl the hash from www.abc.com/hash.dat - compare the computed hash with the "curl'd hash" - only if they match, pipe www.xyz.com/install.sh to bash In that case, a malicious actor would need to hack at least two locations to be successful.