So my Linux kernel running the majority of the infrastructure of the company I work for is untrustworthy? Do you not trust kernel.org? Or the GPG signatures of

So my Linux kernel running the majority of the infrastructure of the company I work for is untrustworthy? Do you not trust kernel.org? Or the GPG signatures of the commits? What about Mozilla? As for "someone that can be sued", have you read any of the EULAs of the commercial entities that you think are "reputable" and "100% trustworthy"? You can't sue them. Similarly, do you trust all of the CAs that have certificates in your OS or browser trust store?