You make the decision to trust some entity 'X' that has some probability of being compromised. If it isn't compromised you're good and if it is you're screwed,

You make the decision to trust some entity 'X' that has some probability of being compromised. If it isn't compromised you're good and if it is you're screwed, but as you add additional entities each introduces an additional individual probability of being 'bad'. There's an argument that it's better to trust one entity entirely in order to have a greater chance of being fully 'safe' rather than split your trust and having a higher chance of being partially compromised since partial compromise is often equivalent to being fully compromised. It's the same idea that leads the Tor network to use entry guard nodes: https://www.torproject.org/docs/faq.html.en#EntryGuards https://www.torproject.org/docs/faq.html.en#EntryGuards