Mental exercise of abstraction

I have built an application so that narcos can communicate anonymously.

But I will know who are the narcos using it unless the narcos activate some options in the app.

On the other hand I have put in GitHub the code of my server with which I assure you that they are anonymous, but there is no way to verify that this code is really the one I run on my servers.

There is also no way to verify that the calls are not being selected for eavesdropping.

Plus I am funded by a publicly traded company.

The narcos think I am insulting them intellectually.

Why should the narcos trust me?

The narcos say they only trust communication systems that they themselves can host.