This doesn't seem like a new problem. If mycoolfacebook.example is a new frontend for Facebook, it must only talk to Facebook's backend, this is reasonably easy

This doesn't seem like a new problem. If mycoolfacebook.example is a new frontend for Facebook, it must only talk to Facebook's backend, this is reasonably easy to verify. If it has its own backend, we'll have the same concerns we already have about Facebook.