Comment by weeks

Code review, trusted build environments and code signing could entirely prevent a single engineer from modifying the code running on the car.