Comment by paulgb

Right, but how do we know that https://retriever.corgea.io faithfully returns the code in that GitHub repo? We still have to trust corgea.io.