Trusting a million eyes is acceptable for most people's threat models. I trust (Apple AND a community of people who can tell me the hash of the build) much more

Trusting a million eyes is acceptable for most people's threat models. I trust (Apple AND a community of people who can tell me the hash of the build) much more than I trust Apple alone. It's like if you're trying to figure out how a magician does a trick, "he must have a collaborator in the audience" is a reasonable guess. "Everyone in the audience other than me is a collaborator" is usually not.