> There must be some mechanism to prevent tampering in such a setup.

Trivial as long as they terminate the TLS on their end, not yours. So you'd just be a residential proxy.