I don't understand what you mean when you refer to a singular "trusted authority".
Users have to trust that the group as a whole does not partake in any malicious behavior.
But this level of trust is already existent with the development of the reference client?