I’ve had it on my todo for years to work through ddc and trusting trust.
Which is a method to verify a compiler is matching its source and thus trustworthy.

An orthogonal approach is reproducible builds, which among many benefits can make sure a few people verifying things benefit everyone who can then see they have the same verified binaries.