[hestefisk]

Exactly. A hash to verify the authenticity of the file / binary itself is what’s missing. Https is not enough.