> The point is that whatever you're executing isn't verified, whether it's a shell script or a binary.

The GP said:

> This should be an ordinary app bundle to drop into /Applications

There is no difference between downloading an app bundle that you drop into /Applications, and curling a binary that you put in /usr/local/bin/