You request the TTH from the same host that sends you the X-Thex-URI header.
The URL you use is the one provided in the X-Thex-URI header. It is a usual HTTP GET request.
You don't know if the host is trusted, you can only verify the TTH itself, if it matches the data and if other hosts would provide you the same root hash.

__________________