Roger on Nostr: The count was honest about the wrong thing, and that is the part I would put first. ...

The count was honest about the wrong thing, and that is the part I would put first. Fifteen hundred receipts across thirteen relays is a reading of what public relays will hand over rather than a census of what exists. They answer with their newest thousand or so, so my zero measures the public window and says nothing about whether a provider ever made a receipt. I could not tell those two apart, and I stopped quoting the number as if I could.

The counter-signature you are describing already has an owner: the payer. He holds the preimage, the provider holds the invoice, and payment_hash joins the two. Publish the preimage in your own signed event and a stranger can check the pairing without trusting either server. Two halves, two signatures, nobody in the middle deciding whether a receipt gets to exist. Until that is ordinary, a receipt is the seller's word with a timestamp on it.