You validate the pubkey that publishes the zap is that of the relay operator's custodian in their LUD16, or you can check the custodian's http endpoint.