In this context bootstrapping refers to building binaries for an architecture from source without using any pre-built binaries for that architecture. In the past 20 years about 20 architectures have been bootstrapped for Debian. At all times this has been a manual and non-repeatable process. rebootstrap is trying to address the very early bootstrap phase involving the gcc/eglibc dance.

What does it mean to “distrust the infrastructure”? A core tenet of the Qubes philosophy is “distrust the infrastructure,” where “the infrastructure” refers to things like hosting providers, CDNs, DNS services, package repositories, email servers, PGP keyservers, etc. As a project, we focus on securing endpoints instead of attempting to secure “the middle” (i.e., the infrastructure), since one of our primary goals is to free users from being forced to entrust their security to unknown third parties. Instead, our aim is for users to be required to trust as few entities as possible (ideally, only themselves and any known persons whom they voluntarily decide to trust). Users can never fully control all the infrastructure they rely upon, and they can never fully trust all the entities who do control it. Therefore, we believe the best solution is not to attempt to make the infrastructure trustworthy, but instead to concentrate on solutions that obviate the need to do so. We believe that many attempts to make the infrastructure appear trustworthy actually provide only the illusion of security and are ultimately a disservice to real users. Since we don’t want to encourage or endorse this, we make our distrust of the infrastructure explicit. [https://www.qubes-os.org/faq/#should-i-trust-this-website Also see: Should I trust this website?]

Fastly generously hosts our Tor Browser update downloads that can be fetched anonymously.

Onion addresses provide a higher standard of authentication than clearnet addresses.

Onion services offer strong authentication via [https://support.torproject.org/onionservices/ multiple layers of encryption]. This does not prohibit an advanced adversary from trying to impersonate an onion service, but together with multiple fingerprint sources, it becomes increasingly difficult and improbable that a single entity could impersonate them all.

Software development teams face a critical threat to the security of their systems: insiders.
[...] An insider threat is a current or former employee, business partner, or contractor who has access to an organization’s data, network, source code, or other sensitive information who may intentionally misuse this information and negatively affect the availability, integrity, or confidentiality of the organization’s information system.

I never lived there
I never traveled there
I had no company there
But all I worked for now belongs to the U.S. [https://www.techdirt.com/articles/20150326/18041530458/how-us-government-legally-stole-millions-kim-dotcom.shtml How The US Government Legally Stole Millions From Kim Dotcom]