A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a G

A certificate that says "this installer really did come from the owner of exampleapp.com" is better than users just trusting whatever random file came up in a Google search. And meanwhile, in Linux land, people will install things by piping curl into bash[0][1], so the bar is just not that high. And the ultimate answer to security will come from better app sandboxing, not from charging every native-app developer in the world $700/year for a code signing certificate. [0] https://docs.chef.io/chef_install_script/ https://docs.chef.io/chef_install_script/ [1] https://github.com/zyedidia/micro#quick-install-script https://github.com/zyedidia/micro#quick-install-script