This is cool as heck. Outside of architectural attacks, this seems like a practical response to Reflections on Trusting Trust (<a href="http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf" rel="nofollow">http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...</a>).<p>While we can definitely discuss whether it's practical for anyone to actually audit all that source code (no it is not), proving a 356 bytes codestream isn't malicious seems like a good foundation to argue about.