lets assume my inbox is jellyfish relay which is paid. and im subscribed there.

you want to send me a dm. if the relay only checks the p tag, anybody can send me dms and spam me.

but if check the sender is subscribed as well, it can control who is sending the dm.

my last idea (which i think you believe hurts the privacy): make sure the publisher is whitelisted using auth.

if people trust that the relay won't log the information, it won't hurt the privacy.