Yes, trust is absolutely an issue here. I put the code on GitHub so people can run it themselves. On the other hand, people also trust websites like gmail, their bank accounts and government stuff with their private data, without knowing anything about the encryption/decryption process behind it...