So I checked out the accuracy of the installer movements: I created a brand new .dmg on my mini-Mac (macOS Catalina v-10.15.7) I did an md5: 9acd996a9705de6d4f9cf1290d350436 I logged the mini-Mac into my github repository and placed the .dmg into release. I logged out of the repository. I enabled the Gatekeeper to accept files from anywhere. I logged back in and downloaded said .dmg into a different folder. md5 on the downloaded file gave again 9acd996a9705de6d4f9cf1290d350436, i.e. the file was identical. After removing the original, functioning version, I tried to reinstall from the downloaded version. -> "GS_MV is damaged, and can't be opened. You should move it to the trash!" I repeated the whole experiment with the .dmg file 'locked', no difference.

Yes, it works fine. In the mean time I also found a way around: If I download the installer on a non-Apple computer onto a usb-stick, and then plug the usb stick into thea Mac, it can be installed without problems. The Apple police only prevents direct download/installation. But many users will be much inconvenienced, if they have to go through this extra hurdle.