Comment by serf

a script isn't getting hashed to see whether or not it's the one the website intended to serve you, for one.

what use is hashing every piece of software that goes thru the distros package manager just to throw caution to the wind at the layer above it?

w.r.t. "it's already from the same domain" , well most bash/z install scripts either invoke a package manager or they download and untar a package that has nothing to do with the host domain, anyway.