My worry isn’t about the method of proving authorship. Once a third-party apt repo is added it has to be trusted in perpetuity. Every time I run apt upgrade the third party site has an opportunity to slip something new and nefarious in. At least with curl|bash it’s a one time risk.