If they aren't willing to publish the files (though many, many sensitive documents have been published while protecting the source!) than they can use a second or third news source to validate the files. This happened with the original panama papers before many of them were publically published - 4-5 papers all vetted them in chunks.
"Trust me bro" doesn't cut it, especially not for The Guardian.