This backdoor resided in git for a year without anyone noticing. It wasn't until it was activated via the tarball that someone found out. One could easily argu

This backdoor resided in git for a year without anyone noticing. It wasn't until it was activated via the tarball that someone found out. One could easily argue that signed tarballs are more vetted than git commits.