That would break every time there was a new release of pylauncher. But it looks like there hasn't been a release for nearly a year now, so maybe we'd get away with it.

Let's leave it for now. HTTPS should make it fairly difficult for a malicious actor to replace the MSI in transit, and I'm a big fan of keeping things simple until we actually have a need for more complexity.