The golden rule seems to be 'trust but verify', and a little bit of knowledge goes a long way during the 'verify' stage.