And rolling hashes of every build. And a device to constantly cross-check the hashes. And a device to constantly verify that the cross-checker was working. And

And rolling hashes of every build. And a device to constantly cross-check the hashes. And a device to constantly verify that the cross-checker was working. And a workflow to show diffs of each commit. And time to read through them, grok them, and sandbox-test that they weren't doing anything nasty in an obfuscated way. At the end of the day, you really can't trust anything completely, and the only real solution is to 1) trust Amazon (which doesn't seem like a great bet right now), or 2) don't own one.