Of course it&#x27;s signed in your repositories, but if it&#x27;s in the repositories you wouldn&#x27;t be doing curl|bash anyway, you&#x27;d grab it from the repositories. The point is to distribute software that is not in there, which is not even packaged as a .deb&#x2F;.rpm (or whichever distro you&#x27;re using).<p>You could still sign the .sh installer with GPG, but then you&#x27;d have to get the public key from somewhere (and get people to care about verifying the sig first). If you&#x27;re communicating a key somewhere, you might as well just publish the hash sum and communicate that.