That would require every user to validate the sources themselves.

See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)