No, not really. Once I install the extension, unless I do something unusual, I've signed up to automatically download and run whatever code is signed with the right key and put in the update channel. If the dev isn't trustworthy, I'm almost certainly going to be hosed before I know I have a problem. Being able to see exactly how I got hosed, after the fact, is somewhat cold comfort.