How can one trust a domain when literally anyone can create a subdomain on it to use for “verification”.