Good points. This is really challenging topic
I agree it's not something most Bitcoiners want to discuss because it leads to questioning the “don't trust, verify” ethos. But I think taking that mantra too literally has always been problematic because most people will never verify all of the hardware, firmware, cryptography, and source code they use for Bitcoin. But Bitcoin has always allowed something still very powerful, if not as catchy as a slogan: “Choose who you trust.” That's what we're doing with cashu.