This doesn't do anything. NSA is intercepting specific shipments. Unless you happen to be a target of the same program, what you're auditing is not the same as what the target received.

We might want to move to mostly FPGA-based or similar reconfigurable systems, where what we perceive as hardware is more easily audited.

OR we might want to go back to shopping anonymously "offline", hoping that the NSA will not bother backdooring every device on the market.

What bitstream is the FPGA currently configured with? The one in flash? Really? What's to say the bitstream made it to the FPGA correctly? Can you tell? What if it reconfigured itself [1]?

There's some research [2] into using authenticated, encrypted bitstreams, but even if the implementation matches the theory (and after all, it's crypto, we know how that goes...) this only reaches the same level of security as a fixed-configuration ASIC, since FPGAs are vulnerable to the same nefarious fab attacks as ASICs.

1: http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_f...

2: http://www.saardrimer.com/sd410/papers/bsauth.pdf

FPGA bitstreams are big, sometimes even big enough that you couldn't fit another bitstream in hardware anywhere. What's more, making even a small change to the bitstream and re-synthesising tends to completely change how the design is laid out in hardware - so launching an attack that targets a specific bitstream, like most of the obvious nefarious-fab attacks, isn't much good.

Nobody has time to do that. Ultimately you have to trust someone, thus this is more a political problem than a technical one.

You have to trust someone, but we can move in either direction along the spectrum from "I have to trust all of these many people and if any of them is untrustworthy I'm boned" to "I have to trust some of these many people and if all of them are untrustworthy I'm boned". There are both technological and political elements to any solution here.

Regularly? Almost any major software/hardware project changes iteratively over time. You just have to audit the changes between major releases, which for firmware, are typically very irregular.

Also, just transitioning to a more open process with an open codebase has the effect of "keeping them honest". Once the code is out there, they have no way of knowing who might be scrutinizing it and have no chance to retroactively cover something up.

This is why it's such a big deal when companies make a commitment to openness (the real kind -- not the buzzword kind). It's a statement of being willing to forego most of the dirty tactics that being closed source allows and to playing a fair(er) game.