So, in other words, citizens can't verify anything. Instead, all we can do is hope that any abuse will eventually be noticed and reported by some random whistleblower somewhere.
That's hardly sufficient, and especially not with a company like Amazon.
I'm not. Do I think it's likely that they are? No.
> How can we as citizens verify it?
The same way we verify that Google isn't producing broad-scale AI systems looking for specific subsets of people across the GMail data. Investigative reporting, whistle-blowers, regulation/lawmaking, and looking closely at the evidence presented when the government acts. This is why parallel construction is pernicious, as it prevents meaningful oversight of government malfeasance.
End-to-end encryption, and user ownership/encryption of data is also great, but it's not widely available, and many use cases don't work when the service provider can't see the data they're storing. Even when the data is encrypted, you can get a lot of valuable intelligence from metadata.