How do I check that the private file system is setup correctly from hook_requirements()?
There are a few different ways.
Use the \Drupal\Core\Site\Settings class static method get:
if (\Drupal\Core\Site\Settings::get('file_private_path')) {

}

Check for the existence of the stream_wrapper.private service, which is only instantiated when the above check passes. Need to catch the appropriate exception coming from Symfony. Update 2017.01.23 @Berdir suggests using the getContainer method, which means we don't have to catch the exception!
if (\Drupal::hasService('stream_wrapper.private')) {

}

Use the file_system service to check if it's a valid scheme. This will basically check if the above service's class exists.
$fileSystem = \Drupal::service('file_system');

// Check if the private file stream wrapper is ready to use.
if ($fileSystem-&gt;validScheme('private')) {

}