in fact its mostly by pubkeys because most relays cannot tell what youre doing on your connection, its all websocket messages.

I realized it had to be both but that's also a DOS attack vector to silence specific people.