That's an excellent point. Without the ability to verify that the payment hashes match, you should not trust the proxy server.
But there's also not much point in using a proxy in that case.
I'll have to think more on this.