Reproducible builds do not cut it. If you have a known good binary signature, you&#x27;d also have a known good source signature and wouldn&#x27;t have the problem.<p>Or, to put it in better words, where do you get the certificate to check your build from? At extreme paranoia levels, you simply can never be sure you have the same software as everybody else, thus the only safe alternative is reviewing your copy yourself.<p>(How do you know the computer is showing you the correct contents of your files? Didn&#x27;t think that well enough yet.)