How does one verify the integrity of the install-tl-windows.exe TeXLive installation binary? Is there a PGP/GPG signature, or some listing of hashes for the various binaries? I don't like to run installers that I have not validated.
You normally download the installer from CTAN (https://ctan.org/tex-archive/systems/texlive/tlnet). There you find three related files:
install-tl-windows.exe.sha512.asc. The first is the installer itself, the second file contains the SHA512 hash of the first file and the third is a PGP signature of the second file. (So it's a signature of the file containing the hash, not of the installer directly.)