Nitpick: I don't think that they would have to report themselves if what the attacker claims isn't actually true. They could still fail horribly at verifying th

Nitpick: I don't think that they would have to report themselves if what the attacker claims isn't actually true. They could still fail horribly at verifying the claim (and subsequently pay the appropriate "tax" for that failure)