Goreleaser generates checksum files, but the installers (brew/npx/curl) do not use/verify them.