I checked md5sums published on the website or on Twitter or something before, but never a signature. From what I&#x27;ve heard code signing has to be done with a key obtained from the OS vendor anyway, which in Linux&#x27; case (where you&#x27;d normally run curl|bash) is not even possible to begin with.<p>So I doubt signature checking is ever done in practice, at least on systems where curl|bash is an alternative.