Trust isn't absolute. Deploying a malicious version of a given webapp is still harder (and much more visible) than just silently dumping a backend database, so

Trust isn't absolute. Deploying a malicious version of a given webapp is still harder (and much more visible) than just silently dumping a backend database, so I'd trust an implementation that client-side encrypts my data using PRF and passkeys significantly more than one just uploading everything in plaintext.