Note that the Alby lightning addresses are still custodial as their webserver can pass any invoice they please and the sender has no idea who it's going to... and the receiver won't know if they got intercepted...

We're close to solving this in Pub by using Nostr for signing a backwards-compatible successor to Lightning Address