[napoleond]

And how did you verify its integrity? And what is the upgrade path?

[ric2b]

The releases are signed with well-known keys.

But if you don't trust the devs you'll need to use other software, yes.