the problem is clients show nip-05 as a “verified” checkmark like twitter. there is no verification on nostr. it’s permissionless.