Our code is open source, so you can choose to independently verify that if you desire.

We have attempted to minimize binary blobs to a pretty extreme extent. Unfortunately there are a couple of things from vendors that are impossible to remove, but we have made progress on avoiding as many of them that are avoidable as possible. bcantrill did a talk about this (and some other things) https://news.ycombinator.com/item?id=32911048 if you're curious.

That said your overall point that you’re always trusting somebody is absolutely valid.