I don't think it makes any sense given the history of tech companies to count any of them as a trusted source. Open source doesn't ask for your trust, and it is the only way to get off on the right foot.
See also: https://stephango.com/self-guarantee
And yet, I'd wager my life savings that almost no one using open source software actually verifies that it's not malicious in a different way than one would closed source software (ie. reputation), and instead almost everyone just trusts it.