The system is mediated by the browser, so the source code can be inspected by anyone and verified not to leak information.