The decryption only takes place on your local machine. Of course, you'd either have to check the source or, trust them. It very often comes down to trust.