... have a node (with the malicious code) already up and running on a [government] computer, then simply compel the witness to provide his/her credentials.
That's the simplest and most efficient way to proceed (from a government point of view). It is against this kind of threat that we must protect ourselves.