I'm not happy to agree with you here, but a Nostr identity is merely a label or a nickname. The real person behind is what needs verification and that will always involve something beyond Nostr. A meet-up, a NIPS-05 domain, a tweet, a github post, etc.

It's kinda like PGP keys that way. There are many keys for a single signer, often expiring and being remand. You declare your trust, broadcast it and also check who else trusts it before doing so.

This trust factor, the concept of 'where did you get this key', do you trust it, who else trusts it (Web of Trust) is likely critical to using Nostr for more serious operational security messaging al la PGP email signing, code signing, etc.