The entire system is architected so that you don't need to trust them for anything, beyond the trust you generally need to have in open-source developers. What is a specific scenario that concerns you?