If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users

If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.