It sounds good, but if you're distributing the hash through the same channel as the script, then it's open to the same vulnerability (MITM, website breach, whatever)

> adding some sort of common utility to support it could mitigate the most obvious security issues.

Package managers are awesome!