that's a fair point, but the script doesn't do much, and this method should not be normalized. i downloaded the release manually, unpacked it, and moved the binary into ~/bin/

what's left is adding the init command to the shell init script.

and it turns out that this is included as an alternate way to install in the repo README.

i really don't see the point of the install script. the verification it offers is of no value because if the repo is compromised then the install script could be compromised too.