curl -s -L http://nodejs.org/some-script.sh |sh
apt-get:
$ ls -l /etc/apt/trusted.gpg.d/
$ wget http://nmap.org/dist/sigs/nmap-6.01.tgz.asc
$ wget http://nmap.org/dist/nmap-6.01.tgz
$ gpg nmap-6.01.tgz.asc # apt-get --allow-unauthenticated ...Distributing a hash check over HTTPS would offer some protection against man in the middle style attacks, to the extent that TLS protects against man in the middle attacks, but accomplishes nothing if the server has been compromised.
Distributing a signature of the download gives stronger protection, because the private key can be kept offline and encrypted except when in use. Breaking into a server and overwriting a few files is easier than breaking into someone's laptop in the brief moment where they unlock their keypair to sign a release.