Well if you're worried about chain of trust, you could only use recommended extensions on Firefox. They're manually reviewed so you're still only really trusting the organization that runs your browser.

Bonus point if you download the extensions and manually review it yourself.

My comment wasn't clear sorry. I was thinking about privacy, not security.

What I meant is that if you use a commercial OS and browser (and your ISP too) they're still going to exfiltrate your web activity to their servers.