But you don't need to prove that. 1. registering google.com requires it being available, and their registry and registrars prohibit registering already-registe

But you don't need to prove that. 1. registering google.com requires it being available, and their registry and registrars prohibit registering already-registered domains 2. these registries contain the authoritative DNS records for google.com 3. when anyone wants to pull a certificate for `www.google.com`, they first need to create a DNS TXT entry called "acme-challenge.google.com" (for example) Because of this, you know that whoever 'says' they're Google.com actually is Google.com because of how domain names work and because you see the lock icon in your browser. It's all built on trust of registries and registrars operating diligently, and it's checked by pretty much every big company watching for changes to their domains in case of malicious actions.