&gt; But, at <i>some point</i> there must be trust.<p>Do you trust the developers? Okay.<p>Do you trust the developers, their infrastructure, AND the supply chain? Maybe a bitter pill to swallow.<p>Recommended reading: <a href="https:&#x2F;&#x2F;defuse.ca&#x2F;triangle-of-secure-code-delivery.htm" rel="nofollow">https:&#x2F;&#x2F;defuse.ca&#x2F;triangle-of-secure-code-delivery.htm</a>