To "see exactly what's going on", you would need to be sure of what's happening on the server, and I don't know how to do that for sure except for the blockchain.
Meanwhile, here in the real world, let's stick to the better one of the bad choices we have.
You're making a good point. We can, however, write software that makes certain guarantees on the client side. If I'm the only one with the encryption keys, does it really matter what the server does?
This is the basic idea behind zero-knowledge systems using homomorphic encryption to do very cool things.
Meanwhile, here in the real world, let's stick to the better one of the bad choices we have.