How does Proto-Danksharding really work (while being invisible to the EVM)?

After months of searching for explanations about the way Proto-Danksharding works, the best I've gotten are descriptions that partially explain a mechanism for placing data (blobs) into the consensus layer. The data will presumably contain information about layer 2 rollup transactions. As I understand it, these blobs will be stored in parts or samples by different individual nodes, rather than every node. These blobs will not be visible to the execution layer (i.e., the EVM), and therefore they will incur minimal gas fees in comparison to the fees currently incurred by rollups when posting call data to the EVM-readable execution layer. If I got anything wrong, please correct me.

Here's what confuses me about this scheme: If the EVM can't look at the data blobs, how will they be used in a way that takes advantage of the security of the the Ethereum base layer? For example, as I understand it, rollups that use zero knowledge proofs currently post transaction data as call data that is readable by the EVM, along with a proof that is then verified by algorithms executed by the EVM. The EVM can look at the data, look at the proof, and confirm the validity of the data. In this way the Ethereum network itself provides decentralized cryptographic security to those transactions.

So how will this data be used to provide that same security? Obviously entities that are external to the network will be able to look at them in order to verify validity, but how will fraudulent transactions be prevented by the smart contracts themselves? Or are we talking about the same kind of system currently used by optimistic rollups like Arbitrum and Optimism, which (as I understand it) involve actors external to the Ethereum network examining the data and providing fraud proofs as necessary? If so, where does that leave zero-knowledge proofs and other similar approaches?

I have seen some vague references to the idea that something like a zero-knowledge proof being posted in the execution layer call data, but still, wouldn't the EVM have to be able to see the data blobs in order to verify that proof?

That brings me to a broader question: How can smart contracts even use this data to determine how many tokens I have locked up in a rollup contract, if the EVM can't look at it?

I'm sure that there are answers to this question that are either 1) truly simple or 2) can be made simple for a semi-knowledgeable layman like myself. I just haven't been able to find them. Can anyone shed light on this for me? I will also be thankful for any corrections to my statements about how the current system works.

tldr: I need a fairly detailed but not excessively technical explanation of how rollups will use the Proto-Danksharding data blobs to provide cryptographic security without the EVM being able to see them.

EDIT: I have found what (seems to) answer my question about how the Ethereum network can apply zero-knowledge proofs to the blob data without the EVM. The answer (if I am correct in my limited understanding) is found here. If my understanding is correct, in the case of zero-knowledge proofs, the blob data is accompanied by the proof (for example, the KZG commitment) which is then verified by the block builder (who is separated from the block proposer in Proto-Danksharding). This is a task that would have been done by the EVM previously, but is now done by a small number of high-powered nodes that build the blocks and are capable of doing the necessary computations to run the proof.

This means that the whole execution layer will not be involved in verifying this rollup data -- the verification will be centralized and carried out by a single builder [edit: for any given blob]. However, because the data is publicly available for some length of time and its hash value is preserved in call data, others can verify that the builder's computation was correct.

Am I right in my understanding of this? Did I leave anything out? If I am right, doesn't this raise concerns about a compromised/dishonest builder given that there seems to be no mechanism built in to the Ethereum network for verifying the computations done by the builder in this case? Yes, it can be verified by external entities, but that sounds like optimistic rollup security, not zero-knowledge security.