As I see it, there are two solutions to the trust problem.

The strong solution: read the source code.

The weak solution: trust as few actors as possible, if possible a single one - and download from their website.

I was advocating the second solution.