Correct. He'd also have to trust that his own server wasn't compromised.
How would he know if his own server was compromised?