I think he's assuming that browsers defer password storage to some sort of cloud-based password storage service (presumably of your choosing). Hence the mention of needing to trust the cloud.