You don't need to trust the firmware files, you can inspect the build script and ks files and build your own firmware image with the docker container from coderus.
When you don't trust the docker container then you need to do such an environment by yourself.
When you don't trust the Jolla repository then you have a problem, because it is needed for the firmware image creation and not all packages are open and can be rebuild.

I guess that nobody will give a guarantee about the downloadable files.
So when you are in doubt and not keen enough, go with the old update process.

If you can trust yourself and your knowledge, it is better to build the firmware by yourself.

Until now, as far as I know, there were no reports of bricked devices or other negative replies.