You control the keys, but they control the infrastructure.

> how can I trust it?

I don't know, how can you trust anything?

Most of these services actually don't want anything to do with custody, since it is a legal burden. But other than that, it is hard to verify if it is actually only you who has access to the keys.

I think if you are very concerned with it, you should run your own infra. It's how bitcoin is intended to be used anyways