The question of trust is a difficult one when it comes to what is served to your browser. The header is a hint, but any server could send the same header.
You can run a local proxy: Try Out the IC HTTP Proxy: A Leap Towards Decentralized HTTP
This will reduce the level of trust you need to have by operating the HTTP Gateway locally on your own computer, but it’s still very difficult to know for sure if a specific website is running through the proxy or not. This is something that we’re aware of though and would like to find solutions for this in the future.