The source is the user not the relay. That's the fundamental difference here.

Zapstore would be a ton easier if devs only had to sign their homeserver once and could just have access control from there for the releases, ngl.

trust has a structure. nostr says "we trust private keys". pubky says "we trust home servers". other social media says "we trust corporations" you can persuade people to change their trust model, but you can't change a protocol to match people's expectations. as i said, if pubkey claimed to be addr...