make it easy for auditor to check domain against a pubkey