If the whole thing is legit and they made a page about it, they should notice when they lose control over how that page is displayed in various locations. It could be acceptance tested via many proxies. Maybe a counter-interference phishing bot could send emails and fills forms to make sure they go through correctly. Self-safety audits like that could be built into Tor itself so that these "red blood cell"-like bots are themselves distributed processes (maybe only as pre-installed plugins in the full featured Tor browsers).

Unless the Tor site is a honeypot. Hmm a bit odd they don't have any offline validation instructions on there ;)

I guess the downloaded source code could always be diffed with a known legit copy, if it was compiled on a trusted machine.

By the way, how does one determine the right amount of paranoia?

The first response to this thread helped me understand the issues better: http://www.wilderssecurity.com/showthread.php?t=228869