They advertise that passwords are only stored on the server in encrypted form, meaning they couldn’t read them even if they wanted to (or were forced to by a government agency) and you don’t have to trust them not to. This paper shows that several vulnerabilities exist in the protocol which could be exploited by malicious code running on the server (injected by hackers or a government agency), which would then allow an attacker to obtain cleartext-passwords. So you do, in fact, have to trust the servers integrity.