There are trusted copies of historic releases from third-party sources (at least Linux distributions, but there's probably other sources as well), it's pretty e

There are trusted copies of historic releases from third-party sources (at least Linux distributions, but there's probably other sources as well), it's pretty easy to check whether the tags in the git repository match those. (This can be done as the tarballs are a superset of the files in the git repository, the other way around doesn't work).