Google’s “just trust us” is no longer enough