For media possibly, but nip05 is going to have to require client's hitting endpoints, or simply trusting whatever service is proxying it. We rely on client's being able to resolve domain names as they were advertised. :/ We kind of rely on the ability to share hyperlinks directly. If we switched to something like blossom, then media has a unique id and can be polled from known/trusted servers that federate. Clients could simply take the media hash and try it against a list of trusted blossom servers. Otherwise generic media proxy services, which some clients support, but they don't really work all that well, and aren't cheap because they take so much risk.