The client is closed so it can't be independently verified outside of sniffing traffic or decompilation I assume.