Hacker News Reader

It cannot even show that. The server can lie (trivially).

The block chain can't though once the coins are transferred

That assumes the key is actually on the server.

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

The server could simply be running a patched PHP.