Correct. I was addressing the "closed source software" aspect, because some level is trust is required in the server for key distribution regardless of source

Correct. I was addressing the "closed source software" aspect, because some level is trust is required in the server for key distribution regardless of source availability.