How can I verify that the installed packages on a Gentoo system came from the same source that was on a main rotation mirror and/or “blessed” by the Gentoo development team?  

By verifying the checksum located in  /var/db/pkg/$APPNAME/CONTENTS am I only confirming that the source was the same as that which was downloaded from the mirror?

I guess what I’m getting at is how can I be sure I can trust a mirror? 

Thank you very much in advance for any insight provided,

-john