It cannot even show that. The server can lie (trivially).

The block chain can't though once the coins are transferred

That assumes the key is actually on the server.

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

	▲	muvlon 4 hours ago \| parent [-]
		The server could simply be running a patched PHP.