From the d.py tag (credit goes to Gorialis)

bulletproof-debian-install.sh

# Update your package database
(sudo) apt-get update
# Install build and runtime dependencies
(sudo) apt-get install ca-certificates libexpat1 libffi6 libreadline7 libsqlite3-0 libssl1.1 dpkg-dev gcc libbz2-dev libc6-dev libexpat1-dev libffi-dev libgdbm-dev liblzma-dev libncursesw5-dev libreadline-dev libsqlite3-dev libssl-dev make tcl-dev tk-dev wget xz-utils zlib1g-dev gnupg dirmngr

# Download the Python source code & cryptographic signature
wget https://www.python.org/ftp/python/3.7.5/Python-3.7.5.tar.xz
wget https://www.python.org/ftp/python/3.7.5/Python-3.7.5.tar.xz.asc

# Ensure the signing key is available on this machine
gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 0D96DF4D4110E5C43FBFB17F2D347EA6AA65421D

# Verify the signature of this archive (this ensures the release has been downloaded correctly, and hasn't been tampered with)
# Check for words "Good signature"
gpg --batch --verify Python-3.7.5.tar.xz.asc Python-3.7.5.tar.xz

# Unpack the archive and change into that directory
tar -xf Python-3.7.5.tar.xz
cd Python-3.7.5

# Configure this installation to be optimized and enable all extensions
./configure --enable-optimizations --enable-loadable-sqlite-extensions --enable-shared --with-system-expat --with-system-ffi

# Compile your Python installation - this may take a very long time (up to 2 hours!).
# This will run a LOT of tests - do not interrupt or disable these! They ensure your install won't inexplicably break later down the line!
make -j "$(nproc)"

# At this point, your distribution is compiled and can be used from this directory using `./python3.7` if you only need it for testing.

# Install this new distribution to your machine, without overwriting any existing system installs.
(sudo) make altinstall

# You can now delete the Python-3.7.5.tar.xz file and Python-3.7.5 - your install is complete.
# Use your install with the `python3.7` command.