Well, if you're running software from someone you think can deliver malware to you (and not a middleman) then it's a lost cause anyways no? I don't see what the zip file adds. It's not like you're gonna be inspecting the code or binaries.