Can you download their builds directly from github and check their signature?
Discussion
Not sure. Looks like you can build it from source on their GitHub but I don’t see signatures. But not my area of expertise so I could easily be missing if
Source available vs open source. Also, how do you know their source code is the same code that was used to build the app you are running? Especially if they aren't even providing the build, and are just providing the source?
I’m well familiarized with these principles, but I don’t know the answer to these questions in the case of Proton.
Do you just mean this is what I should be asking when evaluating the product?