Another intermediate option is to do a test "roll your own seed" and verify its xpub using an online tool, then do your real one. This is not fool proof thou, as the attacker could have a random variable that selects on average, say, every fifth xpub as the dummy output.