Malware encryptors can be left on the system for forensic investigation to discover. You’re correct that there’s no perfect guarantee the ransomware group didn’

Malware encryptors can be left on the system for forensic investigation to discover. You’re correct that there’s no perfect guarantee the ransomware group didn’t also exfiltrate data using another method, but that would be kind of stupid; the idea of this would be to reduce a hard problem (trust a criminal to secure your data and eventually safely delete it) to a simpler problem (trust a criminal group not to do something economically irrational that also requires extra work and stealth at infection time.) You don’t need network access to verify a PoW blockchain transcript is correct, provided the cost of forging that blockchain segment is high enough (plus you can script payment redemption so it requires a signature from the enclave attesting that the information was destroyed.) I’m pretty sure a resourceful ransomware group can source a few motherboards and CPUs that can’t be traced back to them.