@pichlo thats not @juiceme's point here (correct me if iam wrong)

By being able to recompile from sources, and comparing a precompiled binary (rpm) against own build (rpm) its a matter of comparing if checksums matches. If no match, something was changed in precompiled binary, and there is a reason to be suspicious.