Allow message inspection by proxy without ability to modify it
Can anyone think of a way to allow the proxy to verify that the encrypted message is what it is supposed to be, without being able to replace it with it's own encrypted message?"


The standard solution is for the server to have its own public/private signature keypair.  The server's public key is given to the proxy and the client in some secure way (that is, in a way that the proxy knows that it is the correct key - we don't care about privacy here).  Then, when the server generates an encrypted message, the server signs it using his private key, and the proxy (who has the server's public key) verify the signature (using his copy of the public key).  Then, when the client gets the encrypted message, he also verifies the signature (to check that the proxy has not modified the message).

You may also need to include something to allow the client to detect if the proxy replaced an encrypted message with a previous encrypted signed message (which would pass the signature check); perhaps a time stamp or a sequence number that always increases.

Can this work in your scenario?