If you read the details of schneier's post , he basically says "we don't know".
There might be a backdoor in the cpu you buy, or in the baseband, or in a driver, or in an open source component that you didn't audit, or in your compiler, or even in your USB stick. You always need to trust somebody.