Why the install command, and not just a download button?
Both work. The difference is what macOS does afterwards.
When a browser downloads a file, macOS tags it with an attribute
called com.apple.quarantine. On first launch, Gatekeeper sees
that tag, notices the app was never notarized by Apple, and refuses to open
it — you have to visit
System Settings › Privacy & Security
and click Open Anyway.
curl does not apply that tag. The install command downloads with
curl, checks the file’s SHA-256 against the one recorded here, and
clears any stray attributes before copying the app into Applications. The app
then opens on the first double-click, exactly like anything else.
Every app is still cryptographically signed — with this store’s own
EdDSA key rather than an Apple certificate. In-app updates verify that
signature before installing, so a tampered update is rejected.
If you prefer the download button: after unzipping, run
xattr -dr com.apple.quarantine /Applications/TheApp.app once and
the prompt goes away permanently.
