Then give guidance on why one might choose one license over the other.
Edit: I realize you're not speaking specifically about rustup, but what I said can and should apply to anything you choose to install this way.
0: https://www.rust-lang.org/tools/install#rustup
1: https://github.com/rust-lang/rustup
2: https://forge.rust-lang.org/infra/other-installation-methods...
Discussed here: https://github.com/rust-lang/rustup.rs/issues/1568
It boils down to that the authors have not gotten around to it and are not experts on Authenticode. Apparently the macOS binary is also not signed, so at least Windows isn't being singled out.
To validate your binary you can use the SHA256 checksum that someone posted in the issue two days ago.
If you must use an older rustup, set `$env:RUSTUP_USE_REQWEST` (or `$env:RUSTUP_USE_HYPER` for an even older rustup) to `1`