Is there anything out there written about what trusted means? The PG community seems pretty trusting :)
It basically means the programming language allows the author of the code to break out of the server and access the underlying operating system as the postgres user. I believe this is written in the docs - but I haven't searched recently.