check the nonce and uri

It only is checking that the signature is valid, and not checking that what it signed was the callback uri it's supposed to be signing. So if you have any message signed by the address you can sign into their account (maybe because they used the same address to sign into your website or signed a posting on a public forum with that address)