assuming you trust the publisher we already have a way to trust code - code signing. this is no different.