Do you mean "can't be validated"? Right? Just making sure.

How is trusting the signer of the code repo any different from trusting the author of the validation checker?