sign his PGP key or prove that he owns the wallet with 1 million bitcoins.
He doesn't actually have a single address with all his bitcoin. He has several addresses (roughly 50k) with each address containing some amount above 50 BTC each (the block subsidy, plus the TX fees, plus the begging spam).
As it was said several times, he should sign a message with an
address that is known to be his.