Also have realized at some point that reviewing the PKGBUILD and code in github repo still doesn't check whether the github release files are compromised.