How does one trust a ConTeXt installation?

I want to download the ConTeXt source code from a GitHub mirror, such that I can select a version by checking out a commit.
This is where the problem of verifying that this code hasn’t been tampered with comes into play.
In essence, I want to verify my installations using signatures ("this code was signed by Hans Hagen, and has not been tampered with").

This problem also seems to hold for the scripts provided by the contextgarden mirrors. How do I trust these haven’t been tampered with?