Security stuff should probably have a Hermetic build. And it should be a one-liner to do the build and take a hash of the resulting binary. They should publ

Security stuff should probably have a Hermetic build. And it should be a one-liner to do the build and take a hash of the resulting binary. They should publish source, binaries, and the resulting hash - allowing anyone to easily verify and call them out if the hash doesn't match. Bazel lets you easily do this.