Well...it's got elements of verification though, if used that way. You at least need to be able to get the file onto a webserver. For folks like Lyn Alden running their own domain, it's a pretty decent defense against impersonators, as presumably, Lyn's not providing file hosting to her various clones.

Obviously if you've got an @iris.to address, there's no verification to it, and is just as you say.