You can’t verify that, and they always have the opportunity to go rogue. Even if that doesn’t happen, the problem here is that search engines are the sole practical arbiter of legitimacy anyway; people short on time are typing a search query about converting from one file format to another, getting links to webapps, and trusting that Google has got their back, which it does not. Even if you are squinting hard enough to see which results are ads, there isn’t a guarantee that whichever webapp has the best SEO isn’t malicious either.