*You can of course mandate something like the outer identity must equal the inner identity, or require anonymous at ..., which would make the identity spoofing issue one of anonymisation alone.