jasejok The assurance can come first from acknowledging the seriousness of the threat, and explaining what sort of measures are taken to mitigate the risk. Sounds pretty normal to me, considering there is a threat looming that threatens the integrity of the product.
I think I'm aware of one case of a project describing a specific measure for mitigating "insider attack": Google built a very specific "insider attack resistance" measure into the firmware-upgrade path. That measure is inherently deployed on GrapheneOS devices. I am not personally aware of Google, Apple, etc., documenting what measures they take against government coercion of individual developers.
But, again, it's also -- honestly -- not clear what assurances people would find credible. It's difficult for me to imagine anything that the GrapheneOS team could say that wouldn't cause people to respond with things like:
- Maybe you're being paid to say that,
- Maybe you say that now, but what about when you're threatened with jail,
- etc.
Perhaps it might make sense for concerned individuals to join together to hire independent auditors?