A browser download of the zip can stop with "Apple could not verify craft-anything-cli" (a lone program can't carry its notarization with it, so macOS has to look it up online).