The question is in the subject. If I am running a Bitcoin website, how do I ensure that the webhost doesn't steal bitcoins on the server or replace an address displayed on my website with their own? I know I can encrypt the wallet, but that would prevent the server from automatically paying out. Multisig helps (since the buyer or seller need to agree with what is happening to the money) but the multisig information can still be replaced with that of the webhost.

What is the solution? Do websites like localbitcoins.com do something special?