cloud fodder on Nostr: Ya the thing is, you don't need to trust relays, you get a message from them and you ...

Ya the thing is, you don't need to trust relays, you get a message from them and you verify the sig. Case closed. All the relay can do is send or not send, accept your event or not accept. Even if the relay has a man in the middle it doesn't matter, the sig won't match if there is any tampering.

BUT without signature validation this all goes out the window and we are back to square one. I am very surprised by this and I just looked at amethyst code and I don't see it checking either.. 🤯 doesn't take much imagination to see how easy it would be to fool the masses during this adoption phase and assume anyone's identity.

The web clients, they gotta be checking this right?!... Guess it's not very sovereign of me to not be aware of this, not read the code, and just assume it's a basic nostr principle in all clients to check sigs. Got some catch-up to do..