I'm trying to programmatically verify the owner/creator of a policyId. I assume that I need to verify whether a signing wallet is the same wallet that generated a particular policy id. (I am also using MeshJS endpoint that utilizes CIP-8 = "Message Signing", so a user will sign via nami/eternl/etc via browser interface)
My Research thus far:
I initially assumed that if I use the tx hash to find the UTxO and use the payment address of the inputs, it would give me the creator of said policyId. But this assumption was wrong since I have witnessed that some minting utxos have the minter's address as the input.
One can prove ownership of the UtxO address with this method, but not the policy ID.
I also began looking into reconstructing the tx that generated the policy ID, but that is looking like a dead end for me since I've been told that generating policy ID is for creating new assets and that regenerating the policy ID would only end up changing all the asset fingerprints.
I've been told that a wallet could be generated with Policy keys, but this is something that noone is doing, and doesn't account for people minting collections via a third party and don't own their policy keys. Also some creators just ditch wallets altogether after a mint is over.
I have seen a project implement interfaces which asks the owner to sign with a wallet, or send x amount to an address. So I assume there is a way to implement this.
Is it just not ideal to verify ownership of a policy ID with message signing? Is there a workaround that app/dapp developers are using?