Where is the guarantee that the manufacturer doesn’t know the key?

The Tangem card doesn't have a private key initially. The key is generated when the wallet is created and the card is tapped against the mobile device. Moreover, public and private keys will be regenerated if you reset the card to factory settings and recreate the wallet.
The firmware has been audited by the independent Swiss company Kudelski Security. The firmware audit confirms that the private key is created using a hardware random number generator and that there are no other backdoors or bugs that could result in the loss of funds. The results of the Kudelski Security audit are available here.