RISC-V is just a specification, you could quite happily sneak stuff into the RTL if you beat the right hands with a pipe.

You still have to trust both the verification procedure and the specification i.e. Given how a modern CPU has to have features to manage itself, it's relatively trivial to design a system to do what VW did and recognize when the device is under test.

For example, if you've seen Christopher Domas's talk/s on finding undocumented features of CPUs, any backdoors in a modern CPU will be buried deep in the vendor-specific features or require an extremely esoteric combination of register values and the like.

> You still have to trust both

Yes, you can never 100% get rid of some trust, but it does not mean that you should give up and verify nothing. The more you (are able to) verify, the more secure you are.

The CPU architecture is open source for one, and the boards are designed in such a way as to make outside verification easier. Excited to get my hands on one!

The architecture isn't the chip itself.

So is a lot of malware, that doesn't mean the specification matches the final build. And even if you can verify the board, you can't verify the chip itself or any other IC.