Verifying without knowing key? Say user Bob sends an encrypted message to a server. People can download the message from this server and later get the key directly from Bob.  

Is it possible for the server to somehow verify that users are able to decrypt the message later on with Bob's key without letting the server be capable of decrypting the message itself?  So the server knows the message is being opened but itself can’t “see” the contents? Is it – at least theoretically – feasible to have an implementation which allows for this situation?
A solution from the top of my head:

Bob will end the server $(Enc(m), h(m))$ where $h$ is a collision resistant hash.
Now, Bob will interact with the server and provide a zero-knowledge proof that $m$ is the same one in $Enc(m)$ and $h(m)$.

We note that this verification is in NP (the certificate for the verification is the key used to encrypt $m$). Therefore, it is feasible to do the zero-knowledge proof part in polynomial time.