I'd expect an entity purporting to promote privacy to provide a FOSS tool users can download to run the report themselves (those who care wouldn't mind running

I'd expect an entity purporting to promote privacy to provide a FOSS tool users can download to run the report themselves (those who care wouldn't mind running the report generation for a long time with limited compute), why increase the number of entities? Wanting to be viewed as trustworthy is not the same thing as having successfully convinced potential users they are.