It's much harder to demonstrate the app doesn't have a backdoor, or doesn't leak your data in some obscure way, or doesn't weaken the entropy when creating the keys.