The recommended way to handle this is to use a URI which uniquely identifies the content, such as an IPFS address. Then, while the data is still stored outside

The recommended way to handle this is to use a URI which uniquely identifies the content, such as an IPFS address. Then, while the data is still stored outside the blockchain, anyone who has a copy can trivially prove that it's authentic and you aren't reliant on a particular server. (Just make sure you save/pin a copy of the file on your own system so it doesn't disappear.) I would agree that an NFT pointing at some plain HTTP(S) URL on some random server without so much as a hash to identify the original content is pretty much worthless.