Embed Notice

We need to keep this one in mind, because for quite some time we've been advocating to not download binaries from software authors because there's no way to validate them. People usually seem to react as if that's a purely theoretical concern (surely, we're told, if the author is malicious or their credentials get stolen, the git repo would be corrupt too?), and we're left having to argue that it would be a sensible way for them to be stealthy about the attack...