Or if it, for example, does proof-carrying automatic updates that are verified before install. Something as simple as publishing the hash of the update in a bl

Or if it, for example, does proof-carrying automatic updates that are verified before install. Something as simple as publishing the hash of the update in a blockchain and then widely distributing the source to construct reproducible builds for that hash would go a long way. You don't even need to make it open source, you could just have a robust enough set of geographically distributed testing labs inspect this code and check the published hash code.