open-source cryptography doesn't automatically mean you're running the code that was audited. one overlooked part of @primus_labs' zkTLS infrastructure is its browser extension. Primus has open-sourced the extension, allowing developers to inspect how users generate attestations locally. but a public repository and an installed browser extension are two different trust surfaces. can the released binary be reproduced from the published code? how are updates verified? what happens when browser permissions change? these questions matter because local proof generation still relies on trustworthy client software. to me, the next step in verifiable data infrastructure isn't just proving that HTTPS data is authentic. it's making the software handling that data independently verifiable too. open source enables transparency. reproducible builds make it measurable.