Or, for that matter, a source download. Or one you've hashed (how do you know the hash hasn't been tampered with?), a microprocessor (have you looked at the microcode? the masks), a circuit, etc.

Turtles^H^H^H^H^H^H^HTrust all the way down.

I'm not being entirely facetious, either, given the advice about disposing of electronics after visiting certain countries.