Sure, but doesn't this assume that you cannot the publisher anyway? So why would you not trust their homepage but trust their source-code