They control the software doing the encryption & decryption - they could ship your private keys to themselves if they truly wanted to be evil.

Who would know?