as long as you do proper signing of code, reproducible builds, then your security concerns go away.  <a href="https:&#x2F;&#x2F;defuse.ca&#x2F;triangle-of-secure-code-delivery.htm" rel="nofollow">https:&#x2F;&#x2F;defuse.ca&#x2F;triangle-of-secure-code-delivery.htm</a>