> How would you verify that for any centralized service, open source or not? I think, technically, some sort of honeypot verification could prove a compromise

> How would you verify that for any centralized service, open source or not? I think, technically, some sort of honeypot verification could prove a compromise (i.e. if information that has very little chance of existing naturally in two systems, say a string a guids). But... I agree with your point. I don't think this is actually feasible or realistic, just technically possible.