Confirming via X isnt suitable because 1) too many people at X have access to fake that verification message 2) not everyone has access to X.

A true Pepsi account should setup nip05 address on their domain. Its very easy.