Signatures should have explicit domain field as in siwe Then wallets can show warning if there’s mismatch
Domain as in url? or something else?