> Frustrating when you want something with a verified source, for me it was Wireguard, and don't want to build it locally.

WG has MSI/EXE installers for Windows:

* https://download.wireguard.com/windows-client/

Not sure why they can't pave PKG/DMG files for macOS. As an open source example, MacPorts uses PKG:

* https://www.macports.org/install.php

On my work laptop I don't think I've installed anything from the Mac AppStore (Xcode is available from AppStore and (last I checked) as a downloadable XIP too.)