Still, it would be very hard to make sure that the provided code is indeed the one running on the suspicious machines. The only way I see to make sure of that w

Still, it would be very hard to make sure that the provided code is indeed the one running on the suspicious machines. The only way I see to make sure of that would be to provide tools to compile and flash the hardware, which doesn't make much business sense. This also gives no protection to silicon based backdoors that has nothing to do with OS code.