If I can't verify how much credit they've extended, then even knowing how much assets they have, I can't tell how leveraged they really are.
Solvency has two parts: Assets and liabilities. The 'prove control' is the assets part.
The other side of a solvency proof is that they can, without breaking anyone's privacy) show that every user's account balance adds up to the sum of Bitcoin they control.
In fact, they can prove solvency (that is, that each user has a balance and that they control at least the sum of distinct balances) without ever revealing the total amount they control or even how many accounts they have (other than a log(n)-ish lower bound). http://www.jbonneau.com/doc/DBBCB15-CCS-provisions.pdf
But forget privacy for a moment:
Imagine they were to publish a list of all accounts, all coins, signatures with all coins, and then timestamp that list with Bitcoin. Then the login JS that their site hands out (and which can be checked js pinning extensions) could at login make sure that that document checked out-- that the signatures were vaid, that the coins existed, that the totals summed up, that it was stampped in Bitcoin, and that your own balance was reflected in it. Presumably you see that that approach would essentially work. The only fanciness needed is making it communications efficient and private.
No major exchange bothers to do it right now because the market doesn't demand it and any exchange that did would hurt themselves by causing their customers to care about the risk of insolvency. If you make the customer worry about solvency they won't necessarily be placated by the protocol that proves they're (bitcoin) solvent, so you're better off not raising the issue.
It's unfortunate because this is one of the areas where Bitcoin has a significant advantage over most other valuable assets.