The "enough shuffling to cover all possibilities of the deck" is a server-side-only operation. It's not verified at all, they could replace a pre-shuffled deck with a carefully chosen one if they liked.