This is not exactly about trusting a random node. This is about trusting the node you use to communicate with the blockchain - you most likely issue both types of transactions to the same node. If you don't trust that node then you can't trust anything really - you can't even know whether the node is even really connected to the blockchain or whether it just ...
You can use implementations of existing clients:
Besu - Java implementation
Geth - Go implementation
Parity1 - Rust implementation
1 At this point, I would be careful to use Parity's implementation because Parity has officially stated it won't maintain the codebase any longer and judging by the commit activity, its starting to show already.
Ropsten transactions are confirmed by miners on that POW network.
Rinkeby transactions are confirmed by specific authorized nodes run by the the Geth team. The Ethereum Foundation, Infura, AKASHA and others might also be involved.
Non-validator nodes are run by others in the ethereum space such as PegaSys, Funfair, etc. You can see the list of Rinkeby ...