> When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost.

This obscures how dramatically worse the situation is if you can't even trust display names. Does the ubuntu.com link on wikipedia lead to an ubuntu.com, or something entirely unrelated? Does a script you're reviewing actually pull images from debian.org, or somewhere else?

At some point you have no choice but to trust what they pixels on your screen are telling you.