That's an excellent point. Without the ability to verify that the payment hashes match, you should not trust the proxy server.

But there's also not much point in using a proxy in that case.

I'll have to think more on this.