Multipage Registration form, Confirmation Page Security Issues?
After further investigation, it appears that one option is to make a confirmation page that is called after the form does it's final submission. Essentially, somewhere in the form alter or form functions near the end (after database operations), add a variable to PHP's $_SESSION array that contains the Drupal form ID (a long string of random characters), and add to this array another sub-array that contains all the information you want shown on the confirmation page.

Then, in the confirmation function (or page if you want to do the .tpl.php version), pass the form ID as a variable in the url. Then use this form ID to get the array from the $_SESSION array and retrieve the information.

As an example, see the drupal_set_message() function since it too uses the PHP $_SESSION variable to pass information back to the user on the next page load.

To keep the user from using the browser-back button and resubmitting the same information again, check the $_SESSION variable for the same form-id before committing user changes to the database and stop the attempt if the form-id's match. In some cases (e.g., registering for a new user account), Drupal will complain anyway if one tries to submit duplicate information to the database (e.g., username exists already).