Sure, you must always trust someone. However, you can distribute trust. With open-source software, you distribute trust across many developers, researchers and

Sure, you must always trust someone. However, you can distribute trust. With open-source software, you distribute trust across many developers, researchers and other users. It doesn't always work. But you're not stuck trusting just one entity. Another example is Tor. You can't trust any one relay operator. But Tor does onion routing through three relays (guard, middle and exit) and so it's the design that you're trusting. Basically, the difficulty is identifying what relays you're using, and getting data from them. Plus the fact that the routing changes frequently (10 minutes by default) so adversaries would need data from many relays. Even so, Tor's design can't resist traffic analysis by adversaries with access to global network data, and global attack networks. That was an explicit choice. Because resisting such adversaries would require stuff (random mixing and latency, padding to provide ~constant throughput, etc) that makes the network far less usable, and not scale well.