How do we know your the real Jack now? What if the real Jack removed the nostr.json file from the cash.app domain because the real Jack was hacked? Proof of deniability