All releases prior to and including LLVM8 are signed using this PGP Key from Naville. Verifiable on his Keybase. Security is not now, and will never be based purely on Obscurity. The "Security Companies" might say so to sell more of their products. But no, binary obfuscation won't magically fix all your exploits and bugs, (If not introducing more). Designing an Obfuscator is hard, and keeping the source open definitely leaks the pattern to crackers which could potentially make the crackers'...