Just as spying through eavesdropping on plaintext was defeated through technical means, pushing malicious updates will also be defeated. Tech companies will ha

Just as spying through eavesdropping on plaintext was defeated through technical means, pushing malicious updates will also be defeated. Tech companies will have to declare that their update mechanisms contain no means to apply updates without user consent, and when updates are sent they will publish the hash. Security researchers will independently verify such claims by reverse engineering. Then whoever some government wants to spy on cannot be tricked into installing a malicious update, as suggested by this blog post. Governments are just going to have to accept that fact that their ability to intercept private communication and recover private documents will be reduced to zero in the near future, as it should be.