Re: Maybe that POS ClamAV isn't so bad.
The issue is "Trusting Trust", as in exactly to what level of detail about your systems, hardware and software you have to drill down to before you can establish absolute trust. I've spent almost a decade, off and on, listening to people that worry these things to death and they really do have a clue, either currently working with the TLA's or previous experience. It's an incredibly tedious level of detail. Establishing the root of Trust here is something I'm deeply interested in given my background. Thankfully, no one has called on me to do this professionally. Might drive me madder than I already am.