Just because he signs a message it doesn’t prove anything. I could do something bad, claim I was hacked & sign a message from an address owned by me, linked to this account since 2014. What does that prove?