[roryrjb]

Similarly in my experience apt/deb packaging should be considered for this. There's already node packages in Debian/Ubuntu, to look at examples, it's well documented, tried and tested, they can be signed, and it's straightforward to setup a repo which is completely static, so can be put in S3 or any static server, there's apt-transport-tor, for working over tor, there's apt-transport-s3 for working with private S3 buckets. OK there's some versioning quirks (I've used both launchpad and reprepro) such as tying it to a release version (buster, xenial, bionic, etc..) and having only one version of a package available per release in the case of reprepro, but in my experience it was easy to setup and maintain. Also the penetration of the format means you can consume it, in one form or another on Linux, WSL, ChromeOS, Docker, K8S, etc.