While some scripts are open-source and reviewed by the community, the risks remain significant: Verified Commits on GitHub from Windows PC ( GPG Keys )
The Myth of the "Verified" GitHub Windows 10 Key: What You Need to Know
Retailers like Newegg or Best Buy sell legitimate OEM and Retail keys.