> signature would provide a guarantee of non-maliciousness Nobody said that. A signature guarantees integrity and authorship. > no, you really cannot verify t

> signature would provide a guarantee of non-maliciousness Nobody said that. A signature guarantees integrity and authorship. > no, you really cannot verify that there is no backdoor Again, nobody said that. I was talking about a lower probability to hide a backdoor and higher probability to find it in FLOSS. > simply because you fundamentally cannot trust the hardware and software stack Trust doesn't have to be binary (1 or 0). You can trust but verify.