You still have to trust that what's running on your machine and on the servers is compiled directly from the source you have access to, right?
You can compile the client code yourself. In fact, until recently you had to compile the client code yourself.
is there a trusted compilation service that uses a distributed agreement mechanism, à la blockchain or DHT for validating some git/svn hash against a binary.
every downloadable source publishes its own binary hashes but the whole practice is somewhat moot in the event of server compromise, not to mention build reproducability.
Of course, you have to trust your compiler and OS, but with a service you would have to trust their compiler and OS.
Was never an issue till now though.