I think it’s a big misunderstanding, not a flaw. nip-05 is just a way to alias a pubkey with a domain name. that’s it. using a nip-05 provider you don’t control is like hosting your blog on facebook or blogger. they can rug you at anytime. but that doesn’t mean the capability is flawed, it means you chose a custodian.

Absolutely. I've always said that eventually identity providers would be rated on various criteria and some will be more reputable than others.

And certain custodians of your identity will be better than others. They will be based on reputation.

?