But there is no easy way to make sure that the software that they are checking is what is stored in the device, is there?
We prepared a deterministic build environment, so it's easy to compile the firmware from source and produce bit identical binary to ours and compare them (or their hashes). We'll prepare more materials about how to check this/participate in the signing on the next firmware update.