You can even question if the compiled version running on an instano is the same as the version posted to GitHub. There’s no way to even check what’s running on the server you don’t have access to.

Trust is necessary at some level if your going to participate on any hosted or federated service as you pointed out.