People talk about "noncustodial" and "open source" but they love to use these hosted Docker images they didn't build or verify.