> If you can't trust the developer's signed tarball you can't trust their git repo either The public git repo has a lot more eyes on it. You don't necessarily

> If you can't trust the developer's signed tarball you can't trust their git repo either The public git repo has a lot more eyes on it. You don't necessarily have to trust the developer if 1) you trust at least one of the people who reviewed the code, and 2) you have a way to verify that the code you're running is the same as the code that person reviewed Trusted builds based on the public git repo rather than an unrelated tarball solves part 2 of that problem.