I think Bootstrappable Builds from source without any binaries, plus distributed code audits would do a better job than locking down already existing binaries.

I think Bootstrappable Builds from source without any binaries, plus distributed code audits would do a better job than locking down already existing binaries. https://bootstrappable.org/ https://bootstrappable.org/ https://github.com/crev-dev/ https://github.com/crev-dev/