Is the confirmation of a Google subsidiary, coordination from multiple government security agents and the word of the PHP developers not enough for you? Why not? Why is your bar of proof set so high? The downside of not reacting is far worse than the downside of reacting yet you seem to be suggesting under reacting would be superior?