Is Gentoo externally "owned" (CIA etc) ?

I've just had a problem with my box owned, what it looks like a rootkit that might have been isntalled at least in part through regular system update ( emerge --sync, emerge -uD \@world etc).

So, I've reported about it on Gentoo subreddit: \ rootkits sneaked in the system by Portage rsync?

and this part of the response that I find really concerning:

Rsync throws signature errors all the time all by itself, presumably because the mirror servers are getting …

cia etc gentoo privacy