when you point to a NIP 05 domain in your profile, don't you have to sign that

Yea, not clear what this solves... if the nip 05 response at the domain matches the pub that signed the kind 0 then there's nothing more to prove

Only problem I see with nip05 is clients probably need to detect if their nip05 has been rugpulled by the domain so they can update their kind 0