One thing I'm not quite clear on with regards to OpenID is how I can be sure that my identity provider can't log in to my sites. I feel like I must not understa

One thing I'm not quite clear on with regards to OpenID is how I can be sure that my identity provider can't log in to my sites. I feel like I must not understand OpenID correctly. It seems to me that all the power rests in the hands of the identity provider; that is, the users have to trust the provider both to safeguard their data and to not use it in the way the user did not want (government gets warrant and checks out user's personal activity by asking provider to log them in). Am I totally missing something here? I looked all over Clickpass's site, and while not having to login everywhere is convenient, I'd much rather know that I'm the only one who has the credentials to authenticate as myself. If I'm wrong, I think something should be said on the Clickpass site about how users can know their information is still in their own hands. If I'm right, I don't think I could ever get on board with a site like Clickpass, and I don't understand how others can do it so readily.