Earlier quoted context omitted.
With the current politics, how do you expect minorities to trust a product with their identity and (sometimes) life, if you can’t inspect what’s being done with your data?
Real question : how do you verify that the source code matches the code of the service you’re using? Is there some service that builds and hosts and you can verify what it builds against the hosted location?
Realistically, you will always need a minimum amount of trust, just don't misplace it.