None of those environments should be considered trusted; they are not themselves bootstrapped solely from source, they all rely on long chains of their own bina

None of those environments should be considered trusted; they are not themselves bootstrapped solely from source, they all rely on long chains of their own binaries, and for some things those binaries have relied on external binaries.