The host would prove that the source available online is the exact same code running on the instance, so you know that it wasn't modified by the developer/bad-guy before it went into production.