> Otherwise you have to trust someone that the thing does what it says it does.

I mean, this is always going to be the case with modern computers. No one writes EVERYTHING themselves, so they have to trust someone else. You are trusting the microcode on the CPU, the system calls on your OS, your compiler/interpreter, your standard library.... I get that this is a different sort/level of trust than trusting a third party metrics system, but it isn't fundamentally different. It is all about trusting someone else's work.

As an exercise, I have been building my own computer from scratch. Started as an adder made in transistors. Became a simple three instruction nand cpu (add, sub, jump). Currently building a very minimalistic copy of a 6502 out of ttl. Goal is to create a machine capable of hosting a website with my dev log and schematics for its own creation. I will have developed every piece of software running on it.

Let a thousand implementations bloom, each with its own security bugs!