[nathanaldensr]

This assumes that the developers themselves are not malicious (see: left-pad) and that their signing keys can't be stolen.