Your last question ("can someone I trust confirm this") is exactly the right question.

To get there, you need two things: (1) you need the tools in question to be open, documented, and amenable to analysis. (2) you need to know and trust enough people that one of them is good at assessing tools.

We do our best to be great at (1), and you can improve your own situation re (2), by going to your local cryptoparties, meeting more people, and generally getting more integrated with the global security and privacy community.