I had exactly this in mind. Mostly if I wouldn't trust the author with binaries I wouldn't really trust with source code either.

That’s because most people hear “E2E” and think that somehow means they can automatically trust the client app. It’s a panacea.