This is actually a great question!
All our code is opensource and the community can (and should) audit it on our Github repository.
Our team also have a track record of delivering Keychain for browsers for over 2 years without any incident.