Everything has tradeoffs, but if you're comfortable verifying the authenticity of the software and know what safeguards make sense to protect your key(s), myself and many others see this as a very reasonable approach. With reproducible builds coming very soon, the assurances get even better.