How could we know that it’s not? Have they published any source code that can be independently built and audited?
There is no download link on the official site, and the type of end user that would usually use this does not know what a hash or signature is.