They could support reproducible builds, then any third party could verify the binary they distribute hasn't been monkeyed with.