Pardon my ignorance, but couldn't we just cryptographically sign bash scripts as well?
Perhaps modify the installation script, something like `curl | some-verification-tool | bash`
Perhaps modify the installation script, something like `curl | some-verification-tool | bash`
(PowerShell script signing is based on standard Windows codesigning certificates, but of course this hypothetical bash script signature verifier can use GPG keys instead.)