> Does this rely on the Trust Me Bro model, or is there some way for the client to verify that the provider actually isn't able to see your inputs?

The point of FHE is that you only ever send encrypted data. So if you trust that Google hasn't broken the encryption algorithm entirely, they never access the plaintext.