So to be clear; the solution is then something like

`curl https://raw.githubusercontent.com/my/domain/setup.sh | sh`

Note we dont even have a hash there - just a promise that a third party (github) has a log of whatever was hosted at that url.