The latest fiasco with 0.16.3 has got me thinking.

The sha256sum asc keys for the binaries are hosted on bitcoin.org
The binaries are hosted on bitcoin.org.
The torrent for the binaries are hosted on bitcoin.org.

--->How can I positively confirm I'm getting an untainted binary given all the data is hosted on centralized bitcoin.org?

I've never looked deeply at the bitcoin core code until this fiasco. But yesterday for the first time i went thru the github commit log...Why are there 1000+ commits for a consensus issue? I see there were tons of changes related to improving code quality. Feels a bit rushed, I would have expected this release to be only a bug fix but it seems a lot more was done. Who is deciding what goes into the latest releases?

Am I insane for thinking I should my own private fork of bitcoin core so that I can validate what changes are pushed to my client? It's way too much work and beyond my abilities, but this experience has left a sour taste.

Hi, I remember when Satoshi used to post here, I would read his posts within minutes of him posting, back then, I thought it could be a scam but deep down I also knew this could be potentially revolutionary tech, even though only anarchists were holding back then, so glad I got in the game.
Well here I am, a decade later, and loving that BTC and posting for the first time on the forums