Installer fetches manifest from Cloud Run, verifies Ed25519 sig using bundled public key, then downloads + installs.
Installer fetches manifest from Cloud Run, verifies Ed25519 sig using bundled public key, then downloads + installs.