Toward Total-System Trustworthiness