[SkyMarshal]

Source code signing goes a long way to solving that problem. Assuming the source author reviews their own code and signs it immediately after.