Literally "Made by <verified domain name>" would go a long way. Cursor is just making poor technical decisions. But then I'm sure we'd have a news story about homoglyph attacks on Cursor.