How do you prevent "trusting trust" attacks with malicious compilers? You don't need a trusted production-grade compiler. It's sufficient to have a really limited trusted compiler or even an untrusted compiler provided the triggers don't overlap. https://www.schneier.com/blog/archives/2006/01/countering_trus.html