I understood that they'll release the source for the decompiled project, so you can build it yourself or compare hashes.

Of course it would be a lot easier to hide malicious code in such a decompiled mess of symbols.