On second glance, the validator is dictated by the domain owner so this falls into the "in case it's the latter, then this doesn't have as big an impact I guess" category.

I'll put this on the backlog of things to implement if I'm incredibly bored and want to weaken the security of my infrastructure.