[paxys]

And how do you verify that the CA roots are authentic?

[notriddle]

The Hg history from Mozilla-Central?

[paxys]

Sure but that's still a third party dependency. And then you have to verify that the Firefox source is authentic. My point is there's no way to have a fully self verifying archive.