accept only WebFist responses with proof signed by the domain of the user

Reject lookup if user has address bob@mydomain.com and WebFist proof for that email is not signed by mydomain, but rather by different domain