You nailed it here. The only credible way for anyone to prove the Satoshi's address belongs to them is by signing a message from that address. So far, no one claiming to be Satoshi has actually done that, including the so called Craig Wright. The Craig Wright saga teaches us one thing, which is; there are group of people who claim to be Satoshi not because they have any concrete prove to show but because they know key information, dates, and the very first people who where all around Satoshi on the internet when Bitcoin it was created. You must have also heard of the rumor of Hal Finney to most probably be Satoshi. He's dead many years now.