If you have access to the private keys, which I'm assuming as I'm not talking about users trusting the system but rather researches identifying malicious use, t

If you have access to the private keys, which I'm assuming as I'm not talking about users trusting the system but rather researches identifying malicious use, then it's trivially easy to verify that the public keys being used are those, and only those, that correspond to the correct devices. It's not a good system, but it's also not one that is impervious to detection of malicious activity.