[moondev]

What if this project offered binaries from GitHub releases instead? How do you read those?

It's more realistic to decide if you trust the source, GitHub user yamafaktory in this case. Then you can ensure that your method of download uses TLS.

[yamafaktory]

It already does. The releases page has prebuilt binaries for four targets plus a SHA256SUMS file. You can download the tarball straight from GitHub over TLS, verify it against the checksums, and run it. No script involved.