TLS wouldn't help; the greatest risk is the author himself sending a malicious script (no offense, Sergii).
So everyone needs to check the script before running it anyway. Which is easy, because it's a very short script.
(Of course, it's so short that it might as well have been an alias or, even better, just a copy-pasteable git command, but I guess the author really wanted to call it 'git punish'.)
