afaik the npubs is mainly a representation for users. apps use hex.
we (the zapper/zap provider) sign the zap when the payment is received with that key.
this way clients can validate that the zap event is actually signed by the server that received the payment.