Independent audits could be conducted on those privacy enhanced ROMs, if there was enough interest.

I'm not saying this is the most practical solution to this problem but at least it's a possibility.