[moondev]

> Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..."

If you can inject that breaking TLS which secures everything on the internet, why can't you inject your own checksum on the "download page"?

[zbird]

Checksums and the binaries can be stored in different places for redundancy.