I didn't phrase myself clearly enough, apologies! ^^;

What I ment was that most apps can show if a NIP-05 handle is actually the correct one and assigned to the pubkey you are viewing. So, showing the account as actually "verified". Heck do I know which nip5 service Snowden used - I *think* he used nostr-check? x) I don't know if he even has his own domain...

Still, your second half stands true. Let's say Snowden doesn't have a domain - having a valid nip5 of _@edward-snowden.me would still result in a check and a "verified" account, although it is not. So yeah, in this case, comparing the npub to the one on his Twitter (is it even still there?) would be the ultimative truth. Honestly, I hadn't thought this far, I admit that... I would've gotten got by a checkmark. Stupid, I know... ^^;