That’s not true though. Outbox is a convenience thing, not proper authentication.
The closest thing to what I’m talking about is
https://nips.nostr.com/70 . That’s more like how ActivityPub works, for example. But NIP-70 is also unenforceable and more of a suggestion in Nostr.