However, I quickly came to the realization that the metrics I'd try to alter would probably not be sufficient and reveal enough information that the whole thing would be rendered moot.
A nice first step to remediate trust (or at least shift trust relationship to other parties) would be for vendors to implement highly restricted sandbox models (i.e. not allowing _any_ network access and restrict/alter ways of in- and output, like adding noise and artefacts to image data that can leave the app e.g. via share/save to camera roll).