Well, you could read the source of course, to see whether the photo data is sent to the server or whether the cert is generated client-side. And then there is this: https://github.com/bloombergmedia/whatiscode/

I could be convinced either way.