Untrusted code is reviewed and tested before being signed ()