Every Linux distribution for the past 20+ years has been using public key signatures to verify software before installing it. This has the benefit of a system a

Every Linux distribution for the past 20+ years has been using public key signatures to verify software before installing it. This has the benefit of a system already having a trusted key to verify against, so packaging with a Linux distro not only makes installation simpler and more reliable (mirrors for redundancy), it also makes verification simpler. However, it is also trivial to do independent verification. 1) Generate a GPG private key. 2) Upload the public key to a public key server. 3) Sign your software with the key and generate a .asc file. 4) Upload your .asc file along with the software you signed to your hoster of choice. 5) Have the user copy+paste a shell one-liner that will download the files, download the public key from the public key server, import the key, verify the files are signed correctly, and install them. The end result is cryptographic verification of your software before installation (using a 3rd party, or possibly multiple 3rd parties if you use multiple key servers) and the user only had to copy+paste a one-liner. It's not as cool as piping to bash, but it's more secure, and more reliable (what happens when your download fails half way through installing through this bash pipe? what happens if bash hangs half way through? what if you want to install offline?)