There’s still trusting Kagi that what’s in the binary was built from the open source code right?

I can build it myself and skip that step. Or, if the build process is reproducible, you can make trust less of an issue by having a small handful of independent people run their own builds and post their signatures. That way you need those people to all collude with Kagi to forge a bad build. This is how e.g. bitcoind binaries are handled.

With reproducible builds, and the way most people get packages, from their package manager: No.

Fine. Thank you for the clarification.