Not during the copy. However each chunk it protected with a sha256 if I remember rightly.
Yes
that is correct. I can't remember if rclone sets Content-MD5 for multipart but it definitely sets it for single part
That's the md5 of the source but rclone hasn't had a confirmation from s3 that it is correct for multipart uploads.
It occurs to me that we could calculate what the etag should be during the upload and check that. That would be the bullet proof check you were hoping for. For multipart uploads it isn't an md5 but an MD5 of md5s which we can calculate as we upload as we know the chunk size.