And I am saying that there are tools to increase this trust.
I also want to stress that you have no tools really to verify. Open source code is useless, audits are also partially useless. I have done audits myself (as the tech contact for the audited party) and the reality is that they are extremely easy to game and anyway are just point in time snapshots. There is nothing that impedes the company tomorrow to deploy a change that invalidates what was audited. The biggest tools we have are legal protection (I mean, most companies that collect all kind of data disclose that they do nowadays) and economic incentive. Kagi seems to provide good reason to trust them from both these angles.
Obviously, if that's not enough for you, fair enough, but if you are considering a company to be intentionally malicious or deceptive, then even the guarantees you suggest do not guarantee anything, so at this point I really wonder if or how you trust anybody, starting from your ISP, your DNS provider, your browser etc.