%y/uXoRDFU1nOWylss0+1xSFT0UAklRGJbfOzNwGuLxE=.sha256
I really like the approach that @christianbundy outlines with 1 subdomain per feed. That leaves the problem of what the "official" git-ssb install.sh should be.
I'm really keen on some sort of system where blobs are verified by other users on the system. And once a certain threshold is reached, the server will switch to the new version. This has multiple benefits. One is that its much harder to attack. Secondly the verified could mean that they ran some tests or something else, in this case it would be a way to go from rc to final.
I have been thinking of a similar idea for blobs that contain the latest state of a number of feeds for the browser system I'm working on.