From FAQ further down the page: What needs to go wrong for the safety of the Ceremony to break? The ceremony has a "1-of-N" trust assumption, which means

From FAQ further down the page: What needs to go wrong for the safety of the Ceremony to break? The ceremony has a "1-of-N" trust assumption, which means that only a single participant in the entire ceremony needs to destroy or otherwise forget their secret input for everything to be secure. To break the Ceremony output, every participant would have to strip apart the software that they are using to contribute, get that software to give them the secret, and then collude with every single other participant to reconstruct the final secret. A more realistic failure mode is a common bug which leaks the randomness. To combat this, this site has been audited and there are alternative implementations of the contribution software built on entirely different software stacks. This is why there will be thousands of participants using different pieces of software on different operating systems to help prevent single points of failure both in the people and hardware/software.