OK, I misunderstood you. I interpreted: > if someone can become the thing you're trying to validate as someone able to impersonate you, not someone actually

OK, I misunderstood you. I interpreted: > if someone can become the thing you're trying to validate as someone able to impersonate you, not someone actually owning your server. For the latter you're right.