Merge pull request #9823 from f321x/psbt_nostr_verify_authors

fix: verify author pubkey of psbt nostr events

electrum/plugins/psbt_nostr/psbt_nostr.py

@@ -193,6 +193,9 @@ class CosignerWallet(Logger):
                 if event.id in self.known_events:
                     self.logger.info(f'known event {event.id} {util.age(event.created_at)}')
                     continue
+                if not any(event.pubkey == pubkey for _, pubkey in self.cosigner_list):
+                    self.logger.warning(f"got event from unknown author: {event.pubkey}")
+                    continue
                 if event.created_at > now() + self.KEEP_DELAY:
                     # might be malicious
                     continue