> how do you prove the firmware in the flash chip matches source?

Trusted, qualified independent experts: Ala Underwriters Laboratories.