If the application isn't open-source how can he check though? They can show a version without the backdoor to him and build the binary with the backdoor. Or the

If the application isn't open-source how can he check though? They can show a version without the backdoor to him and build the binary with the backdoor. Or there could be vulnerabilities elsewhere (not in Moxie's) code. I don't think you can claim no backdoors unless you have the full application under your control, and have it audited.