How to validate the integrity of a back end?

While the differences between authenticity and integrity are difficult in practice, as your example of a compromised key set illustrates, as far as I understand it, this aims at the network level rather than the logic level. Thus, checking the integrity comes down to trusting the authenticity of the certificate and accepting only such cipher suites that provide ways to detect (possibly blind) modifications by a man in the middle.

Another way to satisfy this would be to allow for any ciphers that guarantee confidentiality and evaluate the integrity of the payload in the application logic, for example by restricting the payload to a fixed data format that itself provides integrity, for example JSON Web Signature.

As to your example of the server being compromised and thus the authenticity claim of the certificate holding but an attacker changing the data: that's not exactly true. While it might not look that way for a client, the authenticity goal as already been breached then: the answering party is no longer who they claim to be but rather the attacker.

Additionally: As the TR is currently in a Trial Use Status, for questions regarding compliance with the TR, the contact data of the document can be used.