Perhaps we need to make a special decrypt program, one that accepts any password and just produces some log files. They can't prove it is not the data (except by claiming they planted it)..
https://ro.uow.edu.au/cgi/viewcontent.cgi?referer=&httpsredi...
Wildly unrealistic but it exists.
Encryption is the one-to-one mapping of a set of bytes to a set of bytes. Software + key is the mapping function. When doing cryptographic forensics you don't use the user's software, you use your own.
So proving that the user's decryption program is fake is trivial and may not even come up as you wouldn't bother running it.
And you can't choose keys in a way that would alter the byte mapping in a way that you can control, the true key will map to the true data, and anything else will map to random bytes.
In fact, what if encryption one day gets so good we cannot distinguish it from plain English? Kinda like trying to spot LLM generated content.