Your physical note is unfortunately not cryptographically signed by you. What is signed is the picture url but nostr:npub1nxy4qpqnld6kmpphjykvx2lqwvxmuxluddwjamm4nc29ds3elyzsm5avr7 can always rug you and replace it with a different photo of a different physical note.