That does seem to be the biggest limitation -- you have to trust that the issuer is running an unmodified version of the open source code.

"Another problem is that your employer will know that you signed up for an anonymous gossip/leak site."

Only if they check your email logs and see that a verification code was sent, which you could plausibly deny having requested. Of course, if you're the only person at your company to sign-up, and you're therefore the only one with one of those codes, that would obviously expose you.