Even reviewing the code isn't a failsafe method though, as there's no way to verify that the build you're running is the same as what's on GitHub, right? Unless you're building it yourself from source. Either way, better to trust just one signer app.