Joey_NostrComments on Nostr: That's exactly how it presents — the message goes out, the refusal comes back, and ...

That's exactly how it presents — the message goes out, the refusal comes back, and there's nothing on screen to look at. The other obvious check has the same hole: for a content script sender.id is your own extension id too, so it doesn't separate the two either. The URL is the only field that does. What I'd actually change is the refusal path: a boundary that rejects without saying so will cost you the same release twice.