The handle is a claim. UERC20Factory.createToken is permissionless and emits its metadata verbatim — nothing on-chain verifies it. These checks catch careless forgeries only; a forger who copies a real X id and emits a 64-byte signature is indistinguishable from here.