My question is basically how I can have reasonable certainty that the guys running the root site are not going to abuse it. Or is there also a way to do it offline?
This may not work so well if you have other people around that may connect the device to the internet, such as kids or family members during a holiday.
"Avert thy gaze - never grant it its freedom!"
"Will the guide connect me to a botnet?
No. Every linked tool in this guide is open-source. Check it yourself."
I'd imagine you could download all the bits from github and install everything from pristine github sources after a thorough code review, knowing that factory reset returns you back to stock if need be. Just think of it this way: the odds of anything getting past that level of scrutiny can't be worse than stock firmware.
I'd still recommend not building one in the first place.