That's approaching a chicken-and-egg problem. Other parties are working on verifiable open hardware, but their work is only worth so much if any useful software can be tampered with at multiple other points in the chain.
Reproducible builds are an absolutely achievable way of adding trust to that particular step and reducing the overall attack surface.
We don't need to live in a world of two extremes, 'curl http:// | sudo bash' or hand-built silicon.
Reproducible builds are an absolutely achievable way of adding trust to that particular step and reducing the overall attack surface.
We don't need to live in a world of two extremes, 'curl http:// | sudo bash' or hand-built silicon.