The correct way to do a signed applet or signed extension is to give the signing key to a third party who has responsibility for auditing it, or at least being "out of the subpoena chain" so when bad stuff happens, they suddenly stop signing new versions.
I kind of wish there were a (well armed) organization which did this for other projects.
Well, it looks like we got ourselves a reader.
Unfortunately, I cannot find a clip of this from the movie Ronin. One of my favorites with Robert DeNiro as a criminal or spy, and not even his own gang of crooks are trusting of him. Among my many favorite quotes (I am reviewing all of them and laughing; the movie is a goldmine [0]):
Spence: You think too hard. Sam (DeNiro): Nobody ever told me that before.
"I'm try'n to think, but nuthin happens!" -Curly Joe
Unfortunately, the trust problem you mention is pervasive. It was a signed applet IIRC, but we both requires you trust the original and modified applets from the developer. I am wishing someone released an auto-encrypting PGP service and client, open-sourced on purpose.
We all know only four people would read the source of that, and two of those would verify the dev key given with the release. :-)