&gt;If you don&#x27;t trust the official client, why do you trust them to be your certificate authority?<p>I took the OP to mean e.g. editing configuration files correctly, rather than a question of the code itself being compromised.<p>In other words, a concern about <i>day-to-day coding</i> rather than <i>security</i>.