99% of the time you are downloading from a domain that you do trust. This check is to detect corruption, not malice. But yes, if you were downloading from an u

99% of the time you are downloading from a domain that you do trust. This check is to detect corruption, not malice. But yes, if you were downloading from an untrusted mirror you would want to check the signature or trusted hash before running the script at all.