Those files you get from `curl | sh` are just whatever happens to be on their internet-facing server (or any CDN server) at the time, whereas signing the actual

Those files you get from `curl | sh` are just whatever happens to be on their internet-facing server (or any CDN server) at the time, whereas signing the actual package instead of the tls certificate for the https connection means that package building and signing could have been done entirely on a secure/isolated machine. Using `curl | sh` you're rolling the dice that the web-facing server didn't get pwned. Using signed packages means you don't care if the web-facing server got pwned.