Fishing with punycode is a mostly solved problem: Show the Unicode characters only if there are no homoglyphs in it. That's why browsers can show them. See "client side mitigations" on https://en.m.wikipedia.org/wiki/IDN_homograph_attack
What software libraries (or algorithm) exist to tell that 2 UTF-8 strings don't have homoglyphs?