There is another assumption: 4. You download the script successfully. It is trivially easy for a MitM to interrupt the download of the script between two TLS

There is another assumption: 4. You download the script successfully. It is trivially easy for a MitM to interrupt the download of the script between two TLS packets, without any CA or server compromises. When you do: curl https://project.com/script.sh | sh Then sh happily executes instructions as they come in. It may be that the script starts by moving important directories aside or by creating large temporary files, so if the script is incomplete the user may end up with a broken system. Or maybe if you're really unlucky an attacker might manage to truncate "rm -Rf /..." to "rm -Rf /". With hashpipe, you are at least guaranteed to have the complete script before you run it. I still don't like the practice, but it is better.