What’s stopping the app from keeping your private key and still not encrypting anything?

I’m not trying to be difficult here, I just don’t see how anything outside of an application whose source you can check yourself can be trusted.

All applications hosted by other people require you to react positively to “just trust me bro”.