The source code alone is less problem than the private keys. If the agencies have private keys of the creators of your OS, who then signed the "signed updates"

The source code alone is less problem than the private keys. If the agencies have private keys of the creators of your OS, who then signed the "signed updates" you've got? Example, recently from Microsoft: In their forums: "Is Update KB3103709 Fake?" http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_start/is-update-kb3103709-fake/c9fea314-1469-4d6f-b22f-d1fa0c11c503?auth=1 http://answers.microsoft.com/en-us/protect/forum/protect_oth... On their site: " Try searching for what you need This page doesn’t exist." https://support.microsoft.com/en-gb/kb/3103709 https://support.microsoft.com/en-gb/kb/3103709