If I download the clam client how to I determine that it is not malware? I don't want to turn on a alien keylogger.
After 156 pages of posts about CLAMs, I think if it were malware someone would have figured it out. Just make sure you download the client from the OP
The vote of confidence is appreciated

As you suggested, the code has likely now been vetted by many people.
Of course, you can always review the code yourself - if you are capable of doing so.
But how do I know that code that has been vetted is what was compiled? There is no checksum delivered with the binary. Do I need to compile it myself?