And also how to prevent check-in spoofing, perhaps with a co-signed / wrapped event from the merchant npub.