We should not call it verification IMHO. The malicious user can create random website and add the rel=me. The "green" link makes impression that the user is "verified".
(I would prefer to have some chain of trust like pgp but with a better UX.)
(I would prefer to have some chain of trust like pgp but with a better UX.)
Instead, there is an area on your profile page with links, and the links themselves that are verified are shown in with a tick - which should indicate "this user is verified as being linked to this website", not "this user is a verified user".
I'd be interested in research that shows that the Mastodon approach confuses people. My hunch is that it doesn't, but it's just a hunch.