In any case, there's a vast difference between trusting binaries running on a local machine v. trusting someone to competently (and not maliciously) administer a remote machine. Shuttleworth's statement would've been less unreasonable in the Before Times when cybercriminals breaking into servers and getting their hands on PII to sell on the Dark Web was an occasional and exceptional thing instead of just Tuesday; that time had been long gone even by then (let alone now).