Yes. What really happens is that the trojan self-propagates in the compiler binary, copied from each iteration as it compiles the next one, always within the b

Yes. What really happens is that the trojan self-propagates in the compiler binary, copied from each iteration as it compiles the next one, always within the binary without existing in the source. And so it could be revealed by examining that binary. ... if, of course, you also knew you could trust your examining tools, including the firmware and hardware. You can't provably do that unless you assembled the entire thing from transistor gates (and even then, you're still accepting somebody else's assertions about electron behavior in that material.) So at some point you have to just decide that there's some level of operations that you do trust.