In theory, the reproducible builds project gives us a pointer here. If *enough* "trustable" agents do the build and get the same result (i.e. each agent's signature validates the same final binary hash) then one can start to build out trust based on regular matching of results.