Here’s the short answer, found near the end of this thread.
The example posed at the beginning of the thread, signal-desktop, is now available as an extrepo (Debian) package. Other packages may be available as flatpaks. Either of these methods would be more secure than executing curl or wget from a template. If I had to resort to the latter, I would create a new template for that purpose and consider it compromised.