Yes, I know. Every app can fake everything.

That's why I think a verification button that opens the same data set somewhere else (that you already know) in the onboarding process is a good solution.

It beats blindly trusting the app or centralizing "Nostr login" to a few honeypot services.

A newcomer that is only part of Nostr group chat and then opens his first new app can do a loooot more with trusting the app he already knows and the Web of Verification that that app has, than with trusting who the other chat members are following.