You rely on a net of diverse independent reviewers instead of a single entity with a particular interest.

A peer reviewed distributed trust net is much more trustworthy.

That single entity consists of many diverse individuals with differing ethics.

As much as the law might try to pretend, companies are not people. Uh, except in the sense that they are compromised of people. So, they literally are people, people combined with capital.

People in a single entity are by definition not independent.

In that sense, no one is independent. We've all got friends and family, or at least people we know. By definition, if you've heard of someone else's software, that person had a social network by which they distributed the software to you.

Social dependency is not binary. Developers in a company a much more dependent from each other and the boss, than reviewers of free software.

Very true. Maybe I misread your previous comment as being more binary than you intended.

Keep in mind that reviewers of free software are also often employees and may have some agenda beyond pure altruism, even if the software isn't copyright of the employer. Open source is big business these days.

Maybe Open Source is big business, but not free software.

It all is. The person contributing to gcc needs to make money somehow.

Well, at least it could be considered tainted by self-interest if you're paranoid. My point was that commercial interest does not prevent quality/security.

There's no such net, nobody is signing the binaries.

Signing is not necessary. Only a comprehensible bug report or patch.

Without signing 1000 people can say it is secure but the maintainer can still send whatever they want