What mechanism allows enforcing payment handler authenticity?

[rsolomakhin]

From TAG review:

8.4 Payment App Authenticity sounds good, but it's not clear if this specification describes a mechanism that allows it to be enforced. More detail would be helpful.

We should mention that payment handlers are identified by service worker scopes, origins of which are compared to the origins of payment method identifiers and the entries in the "supported_origins" list in the payment method manifest.

cc @dbaron

[ianbjacobs]

@rsolomakhin and I made edits to the spec and the good practices wiki and so are closing this issue.