[dmix]

RVM requires GPG keys which is the way to do it properly: https://rvm.io/

[hestefisk]

Exactly. A hash to verify the authenticity of the file / binary itself is what’s missing. Https is not enough.