It's worth noting there is one way to verify camera activity without needing to offer source code or elaborate test setups: embed a "camera-on" LED on the power

It's worth noting there is one way to verify camera activity without needing to offer source code or elaborate test setups: embed a "camera-on" LED on the power circuit. As long as somebody does a teardown to prove it and you're pretty sure no one has compromised your specific machine's hardware, it ought to be safe. I don't meant to detract from the "trusting trust" question, there are lots of issues which really are best handled by just pushing the problem problem outside the average user's threat model. Even source-code verification isn't actually terribly robust on the user level: are you sure you got a clean install? Are you sure nothing has modified it? And so at a certain point "just trust Apple" is entirely reasonable. But I do think we sometimes rely on webs of trust, elaborate app signing schemes, and other software or legal solutions when we could be getting by with a simple hardware answer. (And the entire IoT domain looks a lot like undoing solved hardware problems...)