You have to trust the bunker

But only the bunker (not every app you sign into)

You can also run your own nsecbunker