Verifying that data going across the wire is encrypted is fairly easy to do.

You check the data going out is encrypted and that it is encrypted when it comes back. Is that enough verification for you?

Depending on how much you trust the vendor you can go further - run it in a debugger and check where it gets the key for example.

You lock down access to files like private keys as much as possible to minimize the possibility of this.

For example (not affiliated): https://yubico.com/