Even if they use SSL to encrypt your credentials before sending to Google, and keep your credentials encrypted on their server, they must surely have the abilit

Even if they use SSL to encrypt your credentials before sending to Google, and keep your credentials encrypted on their server, they must surely have the ability to decrypt them at will...?