agree, but also this is where tech needs to get if we want to have private experiences + actual control over downloaded binaries

(could also do dataflow analysis on code in a trusted third party CI system)