And that software is running on a machine that you own and control with verified open firmware running on open hardware with no known security vulnerabilities, with strong encryption on the drive and a locked bios, and not connected to any network (including the internet) where all the devices on that network satisfy the previous conditions.

If any of these are not met then you are trusting someone else with your privacy.

Going that direction, one could argue that what you open source might not be what you are running in production.

Right, you can never be 100% certain it's the same code. But it's a valuable "good faith" step that sets a level of trust between the users and developers.