[palata]

I guess the point of the parent is that if the client was open source, one could audit it.

But you're right, you need to trust something at some point (be it your hardware, at the lowest level).