I don’t think that’s a real problem here though. I couldn’t care less if the Chinese government hosts an install script, if there’s no possibility they could h

I don’t think that’s a real problem here though. I couldn’t care less if the Chinese government hosts an install script, if there’s no possibility they could have changed a single byte of the script. Assuming I have a trusted way of knowing the installer script hash (which is a big assumption), I don’t need authentication for the script download, I only need integrity checks.