Looks like LUD 12 allows a comment where one could put a MAC associated with an invoice & nsec-derived key. nostr client could verify with the mac that the invoice came from a particular npub