Several services offer to create a new tezos wallet/account/key (
tz1...). For example, consider Galleon Wallet. By entering a password, it produces a new wallet:
You then need to choose a set of 12 words, which are used to make a backup and to recover access to the account in case it is needed. My question is, how do I know the private information above is not being shared with anyone? I imagine this can somehow be seen in the source code of the program. But some are not open source. For instance, kukai is a web service that creates wallets. How can we know such creation of wallets is secure? Surely there must be some sort of "official" communication between these services and the blockchain. Is there some protocol that ensures such security, or is that a layer altogether detached from the interaction of these wallet creation services with the blockchain?