Checksums are only for transmission errors. If someone can change the code, they can change the checksum. Indeed, using signed code is massively preferable, an

Checksums are only for transmission errors. If someone can change the code, they can change the checksum. Indeed, using signed code is massively preferable, and it is increasingly common. I was about to write that you can't operate running only signed code, but if you consider git hashes a form of signing then I suppose you largely can these days. However, running unsigned code is still so common that I don't think you can really single out people who pipe curl into sh.