> First, if my application encrypts something, such as if my browser encrypts traffic, then the layers beneath it cannot access the data (without intentionally hacking the application).

If your browser is running on an operating system when it applies the encryption, then yes, you are indeed trusting that OS.