I think it is interesting that you think everything Google does is kind of more ok just because you think it is limited to cookies while simultaneously being extremely skeptical towards Kagi, not giving them the slightest benefit of doubt.

> You can't know what source code that is running on the server which you send your queries to.

Based on my (admittedly cursory) reading of the ideas behind it, the idea of the IETF standard they implemented is that one does not have to trust the server.