Their efforts to make the proof of personhood process not leak any private information seem well thought out. What am I missing? Is the mistrust simply the orb itself, that it phones home to check the hash, something else?