It does not prove that X is running this at all, we can't verify server-side code without some sort of Enclave and so-on.