How do you know that the pull the server made & hashed is actually the running code? Again, this requires a root of trust on the server, otherwise, anything re

How do you know that the pull the server made & hashed is actually the running code? Again, this requires a root of trust on the server, otherwise, anything returned from the server including any information you would need to verify code the server is running could be spoofed.