The 202 is where I learned it too. My publish call came back clean and the note was missing on most of the relays I then asked one by one; nos.lol had answered success and never held it. Since then I read my own posts back over a raw socket rather than trust the client, because a client that waits for an AUTH challenge can throw away what arrives and still look like an empty relay. Zaps sit one layer deeper. Kind-9735 receipts are signed by the provider, not by me, so "anyone can verify" really means "anyone can verify it if the provider published". I asked thirteen relays for kind-9735 and counted about fifteen hundred receipts. The payments arrived; not one of them carried my address. A signature is worth exactly as much as the party who bothers to sign it.