Have you considered that Switzerland and Netherlands might just, you know, hand other agencies your data without telling you?

At this point we're supposed to believe what amounts to feel-good talk.

But I keep asking: "How do we know for sure?"

I haven't done anything illegal nor do I need to protect some mega-important knowledge but I still dislike giving easy access to my data so I automated parts of my workflow to double-encrypt my most important data and send it to several off-sites plus an own self-hosted server.

Sure, they likely know remote Linux network zero-days but the odds of them wanting to target me in particular are minuscule so... ¯\_(ツ)_/¯