A HAF server is very similar to an existing API node in the way it works, and in terms of it's trustworthiness. In other words, if you are using someone else's HAF server, then you're trusting it's data, just like you are trusting data from someone else's API node. And practically speaking, the same goes for trusting data from someone's else hived node. Any external service can be programmed to lie.

So if you want absolute security, you may choose to operate your own infrastructure (your own hived and your own HAF server). In this case, your own hived node, compiled by you from open source code, performs validation on all the data it receives, and you can read the code to verify it is doing the correct thing.

Alternatively, if you don't want to operate your own hived/HAF servers, but still don't want to rely on a single source of truth, you can ask for the same data from multiple public servers, to confirm that they are reporting the same information.