Ideally you need a double-blind checking mechanism definitionally impervious to social engineering.

That may be possible in larger projects but I doubt you can do much in where you have very few maintainers.

I bet the lesson here for future attackers is: do not affect start-up time.