[paxys]

Sure but that's still a third party dependency. And then you have to verify that the Firefox source is authentic. My point is there's no way to have a fully self verifying archive.