Yeah I really wish there was a way for this to be enforced by the browser that the end user could trust. It would have to be a standard, but outside of opening dev tools and toggling offline mode there's no way to be sure.

The funny thing is that it feels safer to download a desktop app and give it the same data even though it's usually much harder to validate if it's shipping your data somewhere else.