`curl | sh` is not signed by a CA. With a conventional package manager, the contents of the package itself is signed, not just the connection to the mirror tha

`curl | sh` is not signed by a CA. With a conventional package manager, the contents of the package itself is signed, not just the connection to the mirror that hosts the package itself. Having a secure connection to the mirror is not necessary in this case because there is no way to modify the package without it being detected. With `curl | sh`, only the connection to the server is signed, but not what you are piping into your shell.