The pool is transport-only; this repo is trust. Below, live events from relays are verified (NIP-01 id hash + BIP-340 schnorr signature) — then one is deliberately tampered with:
import { withVerify } from 'https://nostr-client.github.io/verify/verify.js'
import { Pool } from 'https://nostr-client.github.io/pool/pool.js'
globalThis.__nostrClientPool = withVerify(new Pool())
// import components below this line — they all get verified events only